Layers

Everything in a scene sits in a layer. A layer decides who sees what it holds: the assets, the jobs that ran there, and the programs behind its cells.

Every scene has three:

• Private. Yours. Every member has one, from their first day in the scene.
• Shared. The team's working space, and the default in a team scene.
• Public. What a share link or a public page serves.

Where a thing sits is who sees it. There is no separate permissions screen, because the scene itself is the permissions screen: exposure is visible geography, not a checkbox behind a menu.

Moving a thing is the whole act of sharing

Drag an asset from Private to Shared and your team has it. Move it on to Public and the share link serves it. That move is the entire mechanism; there is no second switch to remember.

Nothing moves on its own. An asset never changes layer because of a migration, a bulk operation, or a new feature. It moves when someone moves it, and the confirmation says what changes: "Your team will see this."

A job runs in a layer

Jobs follow the same rule. A job you run in your Private layer is a rehearsal: full tools, full trace, visible to nobody else. Try the risky prompt, take three attempts at the analysis, and when a run turns out well, move it to Shared. It enters the team's history at that moment, outputs included.

A scene has one job history, filtered by what you can see. Each row wears its layer. Teammates see Shared and Public runs plus their own private ones; a share-link visitor sees Public runs only, as replayable traces.

One rule keeps rehearsal honest: a private job reads with your eyes but writes only to your layer. A job cannot hide while its effects show.

Programs read with their author's eyes

A cell's formula runs with the visibility of the person who saved it. Its output, and its text, are visible wherever the cell sits.

This is how data crosses layers on purpose. You author a cell in Shared whose formula reads a model in your Private layer: the team sees the result, live, and can open the formula to read exactly what it does. What they cannot do is reach the source. Copying the formula into a cell of their own re-runs it with their eyes, and the private reference resolves as not found.

Two consequences worth knowing:

• Publishing a formula publishes its text. The names of its private upstreams appear in it; their contents never do. The move gesture states this before you confirm.
• Authority ends with the author's. If the author loses access to an upstream, the cell keeps its last value and marks itself stale with the reason. It never silently computes with permissions that no longer exist.

Lower layers are substrate

The pattern scales past one cell. Keep the raw tables, the credentials, and the data model in a layer the team never has to scroll past, and publish projection cells into Shared. The team works with clean numbers; the machinery stays out of their way; the trace still records where every number came from.

More layers, named audiences

The three defaults cover most scenes. When they don't, add a layer and name its audience: a supplier layer readable by suppliers and nobody else, an operations layer for the crew. Custom layers and their audiences are declared in blueprints, so a scene's structure and its permissions ship together.

What a layer does not do

If you know layers from a design tool, drop the compositing half: nothing here overrides anything. A layer holds one version of everything in it, and an asset has the same value whichever layer you reach it through. The stack these layers form is the architect's kind — data below, views above, with published results as the interface between them — not the painter's.

There are no per-asset exceptions inside a layer, and no secrecy between colleagues within one: if a teammate must not see it, it belongs in your Private layer, a custom layer they cannot read, or another scene. A layer is an audience you can state in one sentence, and it stays that legible as the scene grows.

Updated 2026-08-14