Channel types and the access model
Channels come in two shapes and two visibilities. The shape is stream (fast chat) or forum (async long-form). The visibility is open — any community member can see and join — or private, which is hidden and invite-only, with the invitation issued by an owner or admin rather than by any member. Direct messages cover one-to-one and small group conversation, and guests are external participants whose access is scoped to specific channels.
Any member can create a channel. Each channel also carries one canvas, its own media, and any workflows scoped to it.
The rule underneath all of it: channel membership is the only content gate. There is no second permissions layer.
Why it matters to you
For confidential work this makes the member list of a channel a confidentiality control rather than an administrative detail. Adding someone — human or agent — grants them everything said in that room.
It also means the structure of your channels is the structure of your access control. There is no way to say "this person is in the channel but should not see that thread".
How to apply it
Default to private for anything client-related or sensitive, and add members deliberately rather than generously.
Check the member list before discussing anything sensitive in a channel you did not create.
Treat adding an agent as the same kind of decision as adding a person, because it grants the same kind of read.
Use separate channels rather than trying to partition one — the tool gives you no way to partition, so the channel boundary must do the work.
When a project ends, remove access as a deliberate step. Nothing expires by itself.
If you ignore this
Because membership is the whole gate, a mistake in the member list is a confidentiality breach with no second control to catch it. And because the event log is durable, a person who saw something they should not have seen cannot be made to un-see it by deleting the message.
The positive side is simplicity: there is exactly one thing to check, and it is visible.
Examples
Rooms with locks and no partitions. You control who comes in; you cannot control what they hear once they are inside.
A project runs with a private client-alpha-analysis channel and a separate private internal-method channel. The client's specialist is in the first only. That is the whole access design, and it is legible at a glance.
One open channel for all client work, on the reasoning that everyone in the community is trustworthy. Trustworthy is not the same as entitled, and some clients' contracts say so explicitly.
Verified against Buzz v0.5.20 · Updated 2 Sep 2026