Signals Notebook: How Does Signals Search Indexing and Access Permissions Work ?

Description

Explains how Signals indexes content and enforces access controls during search, including index timing, tenant isolation, and the two supported access models. Clarifies permission evaluation levels and references available documentation.

Solution

• Access models: Signals supports two methodologies for access control:

  1. Sharing: explicit users/groups assigned directly on an object (e.g., notebook, experiment, attachment)

  2. Access Rules (Security Policy): access determined by matching object properties to policy rules (institutional control, inheritance).

• Indexing behavior: Content is indexed upon save. Index entries include object properties and the users/groups or security policy attributes needed to evaluate access.

• Enforcement timing: Access is evaluated at query time. Search results are filtered so only objects the user is authorized to see are returned.

• Tenant isolation: The search index is isolated per tenant to prevent cross-tenant exposure.

• Permission evaluation level: Permissions are evaluated at the object level according to configuration—e.g., notebook, experiment, or attached document—so that each item’s visibility follows its own sharing or policy settings.

• Best practices/documentation: Refer to the Signals Configuration Guide for detailed differences between sharing and security policies, inheritance behavior, and example use cases. Follow organizational policies to align object properties with Access Rules for consistent enforcement and to apply explicit sharing where granular control is needed.