Arvados

h1. Groups, Projects, Ownership and Permissions Specification

* There are three levels of permission, "can_read", "can_write", and "can_manage".

** "can_read" grants read-only access to the record

** "can_write" permits changes to content (but not metadata) fields of the record.  "can_write" also implies "can_read"

** "can_manage" permits the user to create permission links with @head_uuid@ set to this object.  "can_manage" also implies "can_write" and "can_read"

* All Arvados objects have an @owner_uuid@ field.  Valid uuid types for @owner_uuid@ are "User" or "Group".

* If the @owner_uuid@ of an object is a User, that User has can_manage" permission on that object.

* If @owner_uuid@ of an object is a Group, then that object is a member of that group.

* A "Project" is a subtype of Group that indicates the group should be displayed in the "Projects" section of Workbench.