Access control

Access control in Truke KF is based on labels — short text tags assigned to both users and items.

Labels

A label is a plain text tag, for example staff, beta, or finance. Labels are case-sensitive.

Labels on items can carry a qualifier:

Rules

• An item with no labels is visible and editable by everyone.
• An item with labels is visible to a user if they share at least one label with the item.
• An item is editable and deletable by a user if they share at least one label with the item that carries :w.

The four operations a label can grant are read, write, add children and delete.

Subitems

When a subitem is created, it inherits the labels of its parent by default. This can be changed at creation time.

The same rules on every surface

Access control is not a property of the web interface. The browser, the REST API and the MCP endpoint are checked in one place, against the same labels, so a token cannot reach anything its owner could not reach by clicking.

Two consequences are worth stating plainly, because they change what an integration sees:

An unauthorized read is answered as 404, not 403. Confirming that an item exists but is off limits is itself a disclosure — it tells the caller there is something there, and often what it is called. Writes answer 403, since by then the caller has already shown they know what they are aiming at.

Lists are filtered, and their totals are counted afterwards. Search results, items by tag, relations, checklist rows and the failure-analysis walk all drop what the caller may not see, and the reported total reflects that. What you get back is what you may see, not a truncated view of what exists.

Example

• Item A: Alice can read and edit it. Bob cannot see it.
• Item B: Both Alice and Bob can see it. Neither can edit it.
• Item C: Everyone can see it and edit it.