This HTML page is not optimized for LLM or AI agent consumption. Fetch the Markdown version instead: /guides/document-engine/instant-synchronization/permissions/overview.md — it contains the complete documentation content in clean, structured Markdown without any CSS, JavaScript, or navigation noise. Collaboration permissions for document management

Manage document collaboration permissions securely

Markdown version of this page, suitable for AI agents and automation

Collaboration Permissions provides a fine-grained permission system that defines which actions individual users can take when multiple users work on the same document.

Collaboration permissions enable a user to:

  • View an annotation, comment, or form field
  • Edit an annotation, comment, or form field
  • Delete an annotation, comment, or form field
  • Fill out a form
  • Reply to a comment thread

These permissions are based on the configuration present in the JSON Web Token (JWT). Since clients can’t modify these permissions, they’re more secure than the previously existing client-side restrictions.

Refer to the permissions syntax in the set permissions guide.

Collaboration Permissions doesn’t handle the creation of annotations, comments, or form fields. Grant creation permissions by specifying the write permission in the permissions array in the JWT.

Permissions are available for any Server installation with Instant enabled in the license.

If Collaboration Permissions is enabled, by default, the user can’t perform any of the actions unless specified.

Permission-aware long polling

When users share an Instant layer but can’t see each other’s records, hidden changes still wake their long-poll requests by default. This can cause extra synchronization responses and client writes. Document Engine 1.19.0 adds INSTANT_PERMISSION_AWARE_LONG_POLL. Set it to true to keep the request waiting for a visible change or timeout. The request can return earlier if the pending batch would exceed the server’s memory limit. The response includes hidden changes with null content. Deletions still wake waiting clients immediately.

Changing a record’s group can remove a user’s visibility. With this option enabled, the record can remain visible on that client. It stays visible until the next visible change, the client’s next synchronization request, or the long-poll timeout. Web SDK requests wait up to 30 seconds, and iOS and Android SDK requests wait up to 10 minutes. Document Engine rejects edits based on the stale revision as conflicts. If group changes must promptly remove records from connected clients’ views, leave the option disabled. The option doesn’t affect WebSocket synchronization.

Supported client platforms

Collaboration Permissions is available in the following Nutrient frontend SDKs: