Admin: Security posture FAQ

The questions admins actually get asked, answered against what DraftMesh does today — including where the answer is “not yet”.

Who can see this document?

Per document: open it and use its Share panel. That is the complete list for that document — the people and agents granted on it, and any guest links issued for it.

Across the organization: ⚙ Settings → Administration… → Access review. Every grant and every guest link in every workspace, in one list, with a CSV export for the questionnaire.

Remember what a grant is scoped to: one document. There is no folder-level or workspace-level sharing to also check.

Who approved this version?

Approvals live in the document, as approval markers — who approved, and pinned to the exact content they approved, so an approval that predates a later edit is visibly not an approval of the current text. Open the document and look at its markers and history.

There is no org-wide approvals report yet. You cannot currently ask “show me everything approved this quarter” from one screen; you go document by document.

How do I turn someone’s access off?

Access review → find their row → Revoke. It takes effect on the next request they make; there is no cache to wait out. The same button works for a guest link.

Ending their sign-in session is not something you can do from DraftMesh yet. There is no session listing and no “sign this person out everywhere”. Revoking their grants stops them reaching your documents; disabling the identity itself is done in your identity provider.

Taking away their admin authority is separate, and immediate: Administration… → Overview → their row → Remove admin. The very next thing they ask DraftMesh for is answered as a member. DraftMesh will not let you remove the last admin — promote someone else first.

Removing a person from the organization altogether is not built yet. You can revoke every grant they hold and demote them; the account still lists them among the people it has observed.

Revoking an agent does more, and does it immediately — its credential is deleted, in-flight tasks are failed, and its standing subscriptions are switched off. Its document grants are left behind as inert rows for you to clean up.

Where does SSO live?

In your WorkOS organization, not in DraftMesh. DraftMesh authenticates people through WorkOS AuthKit and maps your WorkOS organization to your DraftMesh account. Which identity provider you use, which domains are allowed, whether SAML or OIDC, and who may authenticate at all are all configured there.

DraftMesh does have one seat-management screen of its own — Administration… → Members, where an admin can invite someone by email at Member or Admin and withdraw a pending invitation. The invitation itself is issued and mailed through your identity provider; DraftMesh is asking it to seat someone, not keeping a user directory. Password policy, login methods, and who may authenticate at all remain the identity provider’s job by design, not gaps in a screen we forgot to build.

What is not here yet

Said plainly, because a prospect’s security team will ask:

• No SCIM or directory sync. DraftMesh does not read your WorkOS directory. It learns a person exists when that person first signs in, which is why the Overview’s member list is labelled as observed — it is a subset of your directory, not a roster.
• No MFA policy inside DraftMesh. Multi-factor is enforced by your identity provider.
• No session listing or session revocation.
• No configurable audit retention. The record is kept indefinitely and cannot be set to expire.
• No ownership-transfer screen. The account’s recorded owner is the billing and accountability contact and cannot be changed from inside DraftMesh. It confers no authority, so this is a bookkeeping limit rather than a lock-in: admin authority itself is freely granted and removed.
• Two roles, no groups. Admin and Member, flat — every admin equal, with no read-only or auditor tier and no way to give someone one section of the console. Document grants are still to individuals.
• No member removal. You can revoke a person’s grants and their admin role; you cannot delete them from the organization in DraftMesh.

Where the rest is written down

Your engineering and security reviewers will want more depth than an in-app guide should carry. Two documents exist for them: an administrator guide covering the same ground with the API surface included, and a security overview written to be handed to a security team as-is — identity, authorization, tenancy, sharing, agent access, audit, encryption, the search index, transport, and backups, each stating today’s posture and its known limits. Neither is published here. The security overview page on this site summarises the posture; get in touch for the current copies.