# 0020 · Anyone who can edit a page can share it

**Status:** Accepted · 2026-10-20. Amends "re-sharing is not transitive" in
[permissions.md](https://codna.me/docs/permissions.md#truth-table).

## Context

Until now only a document's creator could share it. A write grant let someone change a page, move
it and restore it, but not show it to anyone else. The reason was provenance: the set of people who
could see a page always traced back to one person's choices, in a short list that person could
check.

In use, that rule is a bottleneck. A team page is kept up by several people, and whoever wrote the
first draft is the only one who can show it to a newcomer. When they are busy, away or gone, the
page cannot reach anyone new until management transfers it. People expect the editors of a page to
be able to share it: that is what "can edit" means in the tools they already use.

It also blocks what comes next. An agent will be registered as a member of an instance, and the
people responsible for it decide what it knows by sharing with it. If only creators could share,
they could give it only what they wrote themselves.

## Decision

**The creator, or anyone holding a write grant, may share a document.** The write grant can be their
own or a group's, Everyone's included. A reader may not share. An editor shares exactly as a creator
does: read or write, with a person, a group or Everyone, through every path that grants (a direct
share, a share by tag, a preview, an automation, an agent over MCP), because all of them ask
`ExplainShare`.

Five rules keep the provenance this used to give:

- **An editor takes back only the shares they made.** The creator can take back any grant. Every
  grant already records who made it (`granted_by`), so "who can see this, and why" is a list of
  grants with a name on each, and the access list says which ones the caller may remove.
- **A grant stays its first sharer's when someone else raises it.** An editor turning the
  creator's reader into an editor does not make that grant theirs to remove; the raise is in the
  access history. The creator raising a grant does make it theirs. So an editor can never take
  away a share the creator made.
- **The creator is told.** When anyone else widens a page's audience, its creator gets an inbox
  notification naming who shared what with whom, Everyone included. That is the one share
  that notifies nobody else.
- **Editors see who it is shared with.** The access list and the `sharing` summary are for whoever
  may share, as before. That now includes editors, who need them to share sensibly.
- **Folder shares are still the sharer's own pages.** A standing folder share
  ([0014](https://codna.me/docs/adr/0014-standing-folder-shares.md)) reaches only what its owner created. One that reached
  every page its owner could edit would grant on other people's pages as they arrive, which is the
  folder-level permission 0014 rejected.

Unchanged: a quarantined page is shared by nobody, management shares nothing, and a deleted page
cannot gain a grant. An agent, once there is one, never shares, whatever it was given.

A write grant on `raw` carries sharing too. Nobody can change a raw page's content, so its write
grant only ever meant moving it; it now also means sharing it.

## Consequences

- A page is no longer stuck with its creator. Whoever keeps it up can bring the next person in.
- **Giving someone write now lets them pass the page on.** To keep a page's audience in your own
  hands, give read. The share dialog says so next to the choice.
- The creator still sees every grant, can remove any of them, and hears about every widening, so
  they know about every change even when they did not make it.
- A write grant to a large group, or to Everyone, makes everyone in it a possible sharer. That is
  what it says, and the creator is told each time one of them uses it.
- Tag-scoped standing grants stay deferred, but for a narrower reason. "An editor could widen the
  owner's audience" is no longer an objection, since an editor can now do it directly and visibly.
  A tag rule would do it invisibly, on every page the tag later lands on.

## Alternatives rejected

**A per-page switch, "editors can share".** Google Docs has one. It adds a setting to every page and
a question to every share, to express something the read/write choice already does: give read to
someone who should not pass a page on.

**Editors may share, read only.** It keeps editors from making more sharers, but splits "can edit"
into two levels nobody asked for, and an editor could still widen the audience to Everyone.

**Keep creator-only sharing, and let the creator approve an editor's share.** Provenance stays
single-sourced, but every share by an editor waits on the one person this decision is meant to
stop waiting on.