Have you ever set up strict sharing permissions to restrict a specific team member from viewing a sensitive document in your workspace, only to find they could still open it anyway?
It is actually quite common to experience situations where lowering permissions on a sub-page simply does not work. This happens because Notion operates on a principle where broader permissions always override stricter ones across multiple access paths.
Here is the ultimate, comprehensive guide covering everything from the fundamental logic of Notion permissions to securely handling departed team members and external partners.
Quick Answer
To troubleshoot and fix broken Notion permission setups, follow these core rules:
- Understand that Notion uses a broadest-permission wins structure, meaning a workspace-level or parent-page permission will always override a restricted sub-page.
- Before tweaking sub-page access, check the user’s role (Member vs. Guest), Teamspace default settings, and parent-page sharing rules.
- “Full Access” or “Can read” settings do not stop users from manually copying text or taking screenshots, so handle sensitive data carefully.
- Transfer document ownership and adjust sharing settings before deleting a departing member or guest to prevent locked pages.
Method 1: Understanding the 4 Permission Levels and the “Broadest Wins” Rule
To manage your workspace securely, you first need to understand how Notion structures its access hierarchy.
- The 4 Permission Levels: Notion offers four core levels: Full Access (edit and invite others), Can edit (modify content only), Can comment (leave feedback), and Can read (view only).
- The 4 Sharing Targets: You can share content with the entire Workspace, specific members, invited guests via email, or anyone via Public Web publishing.
- The Override Principle: Notion’s official documentation states that the broadest permission always wins. If you grant a team member “Can read” access on a specific sub-page, but they already possess “Can edit” access at the workspace or teamspace level, their editing capability will remain active.
- Prerequisites for Sub-Page Restrictions: Before you try to lock down a sub-page, check these three paths first:
- Is the user a Workspace Member or an External Guest?
- What is the default access level of the parent Teamspace?
- Does the Parent Page grant broader permissions than what you are trying to restrict?
Method 2: Members vs. Guests – Knowing the Difference
Understanding how users are categorized is vital for clean workspace management.
- Guests: Guests are external users invited via email to access specific pages only. Their access is strictly isolated.
- Members: Members are officially part of your Workspace, meaning their access starts much broader depending on workspace and teamspace defaults.
- Offboarding Impact: Because guests only have page-level access, deleting a guest cuts off that specific link. However, deleting a workspace member requires careful pre-planning regarding their private pages.
Method 3: The Myth of “Can Read” Security and Offboarding Pitfalls
Many remote teams rely on “Can read” permissions for external partners, assuming it is 100% secure. However, you must keep limitations in mind.
- Export and Copy Limitations: While “Can read” blocks users from duplicating pages, workspace members can still export pages to PDF or Markdown. Furthermore, manual screenshots or text-copying can never be completely blocked by Notion settings.
- Deleting Departing Members: When you delete a member, their access stops immediately. However, if they owned private pages, those pages can become orphaned or locked unless you transfer ownership or change sharing settings before deletion.
- Re-inviting Rules: If you re-invite the same person later, you must restore them within 30 days as the same role type to recover their previous access history automatically.
FAQ
Q: Why can a user still edit a sub-page even though I set their access to “Can read”? A: This happens because of Notion’s parallel override structure. If that user holds a broader permission (like “Can edit” or “Full Access”) via their Workspace membership, Teamspace defaults, or a Parent Page, the broader permission always wins over the restricted sub-page setting.
Q: Can I completely block people from copying or taking screenshots of my Notion pages? A: No. Notion does not feature native digital rights management (DRM) to block manual text copying or screen captures. Permissions are great for preventing accidental access, but for extremely sensitive data, you should carefully evaluate whether it belongs in Notion at all.