Permissions

Curiosity enforces access at query time — in search, graph traversals, and AI responses. A user never sees a node they can't access, regardless of how the query is written.

Default: no restriction set → visible to all authenticated users.

var team = await graph.CreateTeamAsync("Engineering");  // idempotent
graph.RestrictAccessToTeam(ticket, team);               // restrict before committing

Three patterns:

Source-mirrored — mirror the source's permission model (recommended):

foreach (var group in row.SharedWith)
    graph.RestrictAccessToTeam(node, await graph.CreateTeamAsync(group));

Rule-based — apply a segmentation rule:

if (row.Tier == "Enterprise") graph.RestrictAccessToTeam(ticket, enterpriseTeam);

Public with overrides — open by default, selectively restricted:

if (row.IsConfidential) graph.RestrictAccessToTeam(doc, restrictedTeam);

→ Access control model