[US-17] As a user, I want to comment on a document I can only view (when commenting is enabled), so I can give feedback without edit permissions.

angie commented

2026-08-21 17:45:16 +02:00

Owner

@Jeremiah mentioned "Google separates this into: Viewer, Commenter, Editor. I think having explicit permission to comment is good". anything to add @niko

angie changed title from ~~[US-17]~~ to [US-17] As a user, I want to comment on a document I can only view (when commenting is enabled), so I can give feedback without edit permissions.

2026-08-21 17:45:30 +02:00

niko commented

2026-08-22 18:08:00 +02:00

Owner

I agree with Jeremiah. We should have "commenter" perms. The way i was planning to do it was not with a specific permission for commenting given one by one to users, but more as an option to active on the document (by the editor), if commenting is enabled or not. If enabled, anybody can comment (all the viewers, who have read-only access). I don't know if this is an issue in general or not. What do you say? If commenting option is not active, then nobody can comment.
But we could maintain a whitelist/blacklist of users who are specifically allowed to comment (or banned fro commenting). It would say this whitelisting should be optional. There would be 3 types of commenting :

disabled
enabled (anybody. the blacklist could still be used here to ban someone)
restricted (whitelist/blacklist)

I agree with Jeremiah. We should have "commenter" perms. The way i was planning to do it was not with a specific permission for commenting given one by one to users, but more as an option to active on the document (by the editor), if commenting is enabled or not. If enabled, anybody can comment (all the viewers, who have read-only access). I don't know if this is an issue in general or not. What do you say? If commenting option is not active, then nobody can comment. But we could maintain a whitelist/blacklist of users who are specifically allowed to comment (or banned fro commenting). It would say this whitelisting should be optional. There would be 3 types of commenting : - disabled - enabled (anybody. the blacklist could still be used here to ban someone) - restricted (whitelist/blacklist)

yousef commented

2026-08-25 09:44:29 +02:00

Owner

Why not a "Commenter" role? This seems an established pattern?

jeremiah commented

2026-08-25 09:53:50 +02:00

Owner

I think additive permissions is an easier mental model for people than allowlists and denylists.

A typical document journey: My document is private → My document is shared with a few people with viewer/suggester|commenter/editor permissions → My document is public to view and a few people still have additional permissions

I think additive permissions is an easier mental model for people than allowlists and denylists. A typical document journey: My document is private → My document is shared with a few people with viewer/suggester|commenter/editor permissions → My document is public to view and a few people still have additional permissions

niko commented

2026-08-25 10:21:01 +02:00

Owner

I didn't suggest we shouldn't have the commenter permission. The allowlist is exactly about that and there will be a commenter permission.
I also point out that a document might be in public access without a list of readers, as anybody can read it.
In that case, we might also want anybody to comment. And also a way to ban people from commenting. That will be useful for the social features. It can also be that a social psot is only accessible to some users (readers in ACL) but that all the users who can read, can also comment (and we don't need to double the read permission with a commenter permission) so in that case again, a banlist would be useful, together with the "enabled=true" setting for commenting.

I didn't suggest we shouldn't have the commenter permission. The allowlist is exactly about that and there will be a commenter permission. I also point out that a document might be in public access without a list of readers, as anybody can read it. In that case, we might also want anybody to comment. And also a way to ban people from commenting. That will be useful for the social features. It can also be that a social psot is only accessible to **some** users (readers in ACL) but that all the users who can read, can also comment (and we don't need to double the read permission with a commenter permission) so in that case again, a banlist would be useful, together with the "enabled=true" setting for commenting.

niko added this to the Product Design PDR project

2026-10-13 13:44:54 +02:00

Rows
Columns

[US-17] As a user, I want to comment on a document I can only view (when commenting is enabled), so I can give feedback without edit permissions. #7