What problem does it solve?
Working with cognee's multi-tenant access control is confusing: grants are spread across users, roles, and tenants, enforcement is hidden behind a single dataset-resolution chokepoint, and denied reads silently return empty results. This Skill gives you a complete mental model of how permissions work so you can debug access issues and modify the system correctly.
Core Features & Use Cases
- Permission model reference: Explains principals (User, Role, Tenant), the four permissions (read, write, delete, share), and how ACL grant rows combine through membership.
- Enforcement map: Shows exactly where each operation (add, cognify, search, delete, share) checks permissions via get_authorized_existing_datasets, including the empty-results-instead-of-403 behavior.
- Configuration guidance: Covers the ENABLE_BACKEND_ACCESS_CONTROL and REQUIRE_AUTHENTICATION switches and their multi-tenant vs single-user implications.
- Use Case: A user's search returns nothing and you need to determine whether it is a missing read grant, a tenant isolation issue, or a data problem — this Skill tells you to check ACL grants before inspecting the graph.
Quick Start
Explain why a cognee search against a dataset returns empty results for a specific user and how to grant them read access.
