Core Principles
Channel Inheritance
Permissions automatically inherit from the channel where content is shared. If you can see the channel, you can see what’s in it.
Automatic Access
Send a document to someone via email or channel and they immediately get access. No separate sharing step required.
Bidirectional Links
When you @mention a doc or task, recipients can access it through the reference, maintaining permission context.
Explicit Overrides
You can always set explicit permissions on individual items when needed for sensitive content.
Permission Types
Macro has two main permission mechanisms that work together:Access Levels
Direct permissions assigned to specific entities:- Owner
- Editor
- Viewer
- No Access
Full control over the item
- Edit content and metadata
- Delete the item
- Manage permissions
- Transfer ownership
Channel Roles
Permissions inherited from channel membership:Channel Owner
Channel Owner
Created the channel or was transferred ownership.Can:
- Edit channel settings and description
- Add/remove members
- Delete the channel
- Post messages and share files
- All content shared in channel is accessible to owners
Channel Member
Channel Member
Added to the channel by owner or admin.Can:
- View all channel history
- Post messages and replies
- Share files and links
- Access all documents shared in channel
- @mention channel members
- Add/remove members
- Change channel settings
- Delete the channel
Channel Guest
Channel Guest
Limited access to specific threads or content.Can:
- View threads they’re invited to
- Reply in those threads
- Access files shared directly with them
- See full channel history
- Browse all channel content
- Add other members
How Inheritance Works
Shared in Channel
You share the document in a team channel by:
- Posting a link:
Check out this proposal @doc-link - Uploading directly to channel
- @mentioning it in a message
Permissions Inherit
Everyone in the channel automatically gets access based on their channel role:
- Channel Owners → Editor access to document
- Channel Members → Viewer access to document
- Channel Guests → No access (unless explicitly granted)
You can override inherited permissions on any document. For example, make a specific doc “View Only” even for channel owners, or give a guest Editor access to one file.
Sharing Documents
Quick Share (Cmd+S)
The fastest way to share any document:- Document is posted to the channel or sent via email
- Recipients automatically get access based on context
- You can add a message:
@john Here's the Q4 proposal
Email Sharing
When you attach a document to an email:- Internal Recipients
- External Recipients
Recipients in your workspace get:
- Viewer access by default
- Can open document in Macro
- Real-time collaboration if upgraded to Editor
- Attachment updates if doc changes
@Mention Sharing
When you @mention a document in a message:- If channel members don’t have access → automatically granted Viewer access
- If recipient already has access → no change
- @mention creates bidirectional link you can trace back
Managing Permissions
View Current Permissions
- From Document
- From Channel
- Open document
- Click share icon (top-right) or press Cmd+Shift+S
- See list of who has access and their permission level
- View inherited permissions from channels (in gray)
Change Permissions
Set Permission Level
Click the dropdown next to their name:
- Owner - Full control
- Editor - Can edit
- Viewer - Read only
- Remove - Revoke access
Permission Resolution
When multiple permissions apply, Macro uses the most permissive access:Special Cases
Files from Emails
Auto-Import Behavior
Auto-Import Behavior
When you receive an email with attachments:
- Attachments auto-import to your file storage
- You’re the Owner of the imported file
- Original sender does NOT get access (it’s now your file)
- If you share the file back to them, you grant explicit access
PDF and Media Files
Permission Checking
Permission Checking
PDFs and media files follow the same permission model:
- Full-text search only surfaces files you have access to
- Embedded in documents - viewers can see preview if they have file access
- Viewer access allows downloading the file
- Editor access allows replacing file (keeps same file ID)
@Mentions and Links
Smart Link Behavior
Smart Link Behavior
When you @mention or link to content:If recipient has no access:
- Link shows as reference with request access button
- You get notification: “John requested access to @proposal”
- You can grant access directly from notification
- Link is live and clickable
- Shows preview on hover
- Bidirectional reference is created
Best Practices
Use Channels for Teams
Create channels for teams or projects. Share documents there once - everyone gets access automatically.
Default to Viewer
When in doubt, grant Viewer access. It’s easy to upgrade to Editor later if needed.
Review Channel Members
Periodically review channel membership. Removing someone from a channel revokes inherited access to all channel content.
Explicit for Sensitive Content
For sensitive documents, set explicit permissions instead of relying on channel inheritance.
Security Tips
Good permission hygiene:
- Remove people from channels when they leave projects
- Audit owner/editor access on sensitive docs monthly
- Use guest access for external collaborators (auto-expires)
- Set channel defaults: public vs private, member vs guest default
Troubleshooting
Someone can't access a document I shared
Someone can't access a document I shared
I removed someone but they still have access
I removed someone but they still have access
Likely cause: They have access through multiple paths:
- Direct permission + channel permission
- Member of multiple channels with the content
- Owner/Editor on parent workspace
Channel members can't edit a shared doc
Channel members can't edit a shared doc
External recipient says link is broken
External recipient says link is broken
Cause: External users don’t have automatic access.Fix:
- Open share dialog (Cmd+Shift+S)
- Add their email
- Set to “Viewer” or “Editor”
- Enable “Send invite email”
API and Integrations
When using Macro’s API or integrations, permissions work the same way:- API calls respect user permissions (calls are made as authenticated user)
- Bots and integrations can be granted service account access
- Webhooks only fire for events the user has access to
- Export/import preserves permission metadata
See the API Documentation for details on permission checking and service accounts.