Who can see a value
Every time a value is shown, it is read as the person looking at it, using that person's own Confluence permissions. Capable never uses its own access to show a value someone could not otherwise read.
#Who can read a value
Variable | Readable by |
|---|---|
Space variable | Anyone who can view that space |
Global variable | Anyone who can view the Capable Asset Store space |
Everyone else sees [unavailable] where the value would be, with a tooltip saying why. Signed-out visitors who are refused see Sign in to view this value.
#Values are not private
Restrictions control editing only: anyone who can view the space can read the value, find it in search and see past values in version history. Do not store secrets.
That means passwords, API keys, personal data and anything else you would not paste onto a page in the same space.
#The same rule everywhere
Where | Whose permissions |
|---|---|
On the page | The reader |
PDF and Word exports | The person exporting |
Capable Search panel and usage counts | The person searching. Counts only include pages they can see. |
Published Capable Sites | Only variables from the spaces the site publishes, plus global variables |
#A few things that catch people out
Putting a variable from a restricted space on an open page does not leak it. Readers without access see [unavailable].
For global variables to work for everyone, the Capable Asset Store space must be viewable by everyone who reads the pages that use them.
Restricting a variable's editing does not stop anyone reading it.
#Related
If you can see the space, you can see the value.
