---
title: "Control review permissions in Document Authoring"
canonical_url: "https://www.nutrient.io/guides/document-authoring/review-and-collaboration/permissions/"
md_url: "https://www.nutrient.io/guides/document-authoring/review-and-collaboration/permissions.md"
last_updated: "2026-08-31T00:00:00.000Z"
description: "Control tracked change decisions in the editor, assign document participant roles, and combine both permission checks in Document Authoring review workflows."
---

# Control review permissions

Control editor review actions with [`CreateEditorOptions.canPerformTrackedChange`](https://www.nutrient.io/api/document-authoring/types/createeditoroptions/#canperformtrackedchange). Assign a participant role to enforce document-wide permissions in editor and programmatic workflows.

Before you start, install Nutrient Document Authoring SDK and load it in your app. If you haven’t set it up, refer to the [getting started](https://www.nutrient.io/sdk/document-authoring/getting-started.md) guide.

## Deny revision decisions in the editor

The following example returns `true` for new tracked changes when the editor is already creating them. It limits revision decisions to IDs from a list maintained by your application.

```typescript

import type {
  DocAuthDocument,
  DocAuthEditor,
  DocAuthSystem,
} from '@nutrient-sdk/document-authoring';

export async function createRestrictedReviewEditor(
  system: DocAuthSystem,
  document: DocAuthDocument,
  target: HTMLElement,
  allowedRevisionIds: ReadonlySet<string>,
): Promise<DocAuthEditor> {
  try {
    return await system.createEditor(target, {
      document,
      canPerformTrackedChange(operation, revisionId) {
        if (operation === 'create') {
          return true;
        }

        return revisionId!== undefined && allowedRevisionIds.has(revisionId);
      },
    });
  } catch (error) {
    console.error('Failed to create the review editor.', error);
    throw error;
  }
}

```

The callback receives `create`, `accept`, or `reject`. The `revisionId` argument is present for accept and reject operations.

The callback is synchronous: Returning `false` or throwing denies the operation and leaves the document unchanged. Make it idempotent and free of side effects — return the same result for the same input, and don’t change application state inside it — since the editor may call it more than once while updating controls or processing input.

This callback applies only to tracked change operations that start in the editor. Transactions started by the host through [`DocAuthDocument.transaction()`](https://www.nutrient.io/api/document-authoring/types/docauthdocument/#transaction) don’t call it.

## Assign a document participant role

Set [`LoadDocumentOptions.participant`](https://www.nutrient.io/api/document-authoring/types/loaddocumentoptions/#participant) when you load a document. The role applies to programmatic transactions and editor input for that document.

```typescript

import type {
  DocAuthDocument,
  DocAuthDocumentInput,
  DocAuthSystem,
} from '@nutrient-sdk/document-authoring';

export async function loadForReviewer(
  system: DocAuthSystem,
  input: DocAuthDocumentInput,
): Promise<DocAuthDocument> {
  try {
    return await system.loadDocument(input, {
      participant: {
        author: 'Dana Reviewer',
        role: 'reviewer',
      },
    });
  } catch (error) {
    console.error('Failed to load the document for review.', error);
    throw error;
  }
}

```

Nutrient Document Authoring SDK supports these [`ParticipantRole`](https://www.nutrient.io/api/document-authoring/types/participantrole/) values:

- The `owner` role edits content, creates comments and tracked changes, and accepts or rejects revisions.

- The `reviewer` role creates comments and tracked changes. It also withdraws the reviewer’s pending revisions.

- The `reader` role reads the document without changing it.

A reviewer transaction that changes the document requires [`TransactionOptions.review`](https://www.nutrient.io/api/document-authoring/types/transactionoptions/#review). Its author must match the participant author. This requirement also applies to programmatic comment changes.

Use [`document.getParticipant()`](https://www.nutrient.io/api/document-authoring/types/docauthdocument/#getparticipant) to read the current participant. Use [`document.setParticipant()`](https://www.nutrient.io/api/document-authoring/types/docauthdocument/#setparticipant) to change it without reloading the document. A document without an explicit participant uses the owner role and an empty author label.

## Bind participant labels to authenticated users

The participant `author` is a host-supplied label that Document Authoring records on suggestions and comments — it doesn’t authenticate the participant or verify authorship.

Bind each [`Participant`](https://www.nutrient.io/api/document-authoring/types/participant/) to an authenticated application user. Don’t treat an author label as proof of identity.

## Combine participant roles with the editor callback

Participant policy and `canPerformTrackedChange` are independent checks. An operation proceeds only when both checks pass.

The editor doesn’t automatically hide or disable every control a participant can’t use — a control can remain available even when the participant’s role blocks the operation — so keep application controls aligned with the authenticated user’s role.

## Learn more

Use these guides for related review workflows:

- Refer to the [tracked changes and editor modes](https://www.nutrient.io/guides/document-authoring/review-and-collaboration/tracked-changes-and-editor-modes.md) guide to configure editor review behavior.

- Refer to the [manage tracked changes programmatically](https://www.nutrient.io/guides/document-authoring/review-and-collaboration/programmatic-tracked-changes.md) guide to manage revisions in transactions.

- Refer to the [observe review events](https://www.nutrient.io/guides/document-authoring/review-and-collaboration/review-events.md) guide to listen for review workflow events.
---

## Related pages

- [Review documents with comments](/guides/document-authoring/review-and-collaboration/comments-and-review-workflows.md)
- [Manage comments and review edits from code](/guides/document-authoring/review-and-collaboration/programmatic-comments.md)
- [Manage tracked changes programmatically](/guides/document-authoring/review-and-collaboration/programmatic-tracked-changes.md)
- [Observe review events](/guides/document-authoring/review-and-collaboration/review-events.md)
- [Use tracked changes and editor modes](/guides/document-authoring/review-and-collaboration/tracked-changes-and-editor-modes.md)