Permissions & content scope

The single most important thing to understand about the Mereon API: a connection sees exactly what the person behind it can see, and nothing more.

Resolved live, every request

A token is not a separate identity with its own permission set. It resolves to the user who created it, and each request is evaluated against that user’s current access in Mereon at the moment of the call. Permissions are never snapshotted into the token.

So:

Grant the user access to more content, and their tokens can read it on the next request.
Remove their access, and their tokens lose it immediately. No cache to expire, no token to rotate.
A token can never read content its owner cannot read.

What “scope” filters

Endpoints that return knowledge (topics, items, evidence, duties, issues) and content are filtered to the caller’s visible scope. Two people in the same organization with different access will get different results from the same request, and that is expected.

Some endpoints are inherently personal. For example, assignedToMe on the issues endpoint filters to issues assigned to the connected user.

Reading and writing

Most of the API only reads. A connection that changes something needs a scope for it on top of read, and the person behind it must also be allowed to do that thing in Mereon, checked on every request:

Scope	What it allows
`read`	Every read. Every token has it.
`content:write`	Adding content: uploading videos and guides, and creating documents and adding YouTube videos. Nothing that edits or deletes what exists.
`announcement:write`	Writing, sending and withdrawing announcements.
`narration:synthesize`	Voice narration, drawn from your organization’s allowance.
`training:assign`	Assigning training: requiring lessons and knowledge of people, retraining them, excusing them or moving their due dates, a lesson’s retraining policy, and pop quizzes. Granted to admins and team admins; a team admin reaches only the people on teams they administer, and only an admin may excuse someone.

A personal access token is issued with read only, so the write scopes are granted through the OAuth connect flow today. A POST request such as POST /v1/search is still a read; it exists only to accept long queries in a request body.