Per-folder access, enforced on the server

“Hidden” is not the same as “absent”

Every shared knowledge tool has a permissions screen. You toggle who sees the board deck, who sees the salary sheet, and the UI dutifully greys out the rest. It looks safe. But ask where the bytes are, and the answer is uncomfortable: usually they were already shipped to the client, and a panel decided not to render them. The data is on the disk. The lock is a curtain.

That gap is tolerable when a human is the only reader. It stops being tolerable the moment an agent is. An agent doesn’t respect a greyed-out row - it reads what it can reach, and it reaches everything that got synced.

Monora is built on the opposite default: if you’re not authorized for a folder, it never touches your machine.

The check lives where the bytes do

In Monora the unit of access is the folder, and a folder is one git repository with its access-control list attached. The connector that builds your local working tree doesn’t ask the server “what should I show?” - it asks “what am I allowed to clone?” The permission check runs on the server, on every fetch and every push.

Two consequences follow, and they’re the whole point:

• A folder you can’t read is absent from your clone and from its history. Not collapsed, not redacted - it was never written to your disk, and the diffs that belong to it never left the server.
• A folder you can read but not write rejects your git push. Write permission is a separate gate, enforced the same way, at the same layer.

There is no client-side filter to bypass, no API response to inspect for the fields someone forgot to strip. The thing you can’t see isn’t there to find.

Why the server is the only honest place for it

Client-side access control fails in the boring, predictable ways: a forgotten filter on one endpoint, a debug build that ships the full payload, a sync job that grabs the whole tree “for performance” and trusts the UI to hide it. None of these are exotic. They’re the default failure mode of “permissions as presentation.”

Moving the check to the server changes the question from did we remember to hide it everywhere? to was it ever sent? The second question has one answer per request, decided in one place, and it’s auditable. Every fetch and push leaves a record: who - or which agent - was authorized for what, and when.

The payoff: one brain, the right slice each

Because the boundary is real, you can keep a single company brain instead of fragmenting it into per-team copies that drift apart. The board deck, the salary sheet, the customer data and the engineering docs all live in one tree. Each person and each agent clones exactly the folders they’re cleared for, assembled into a normal git working tree they can read, diff, and push to.

You stop choosing between “one messy shared drive” and “ten siloed ones.” You get one source of truth, sliced per reader, enforced where it counts.

The company brain itself is commoditized. The permission layer is the product. That’s Monora.