What a person may reach, and who may change it

Every person's authority over every compartment is exactly one of three

levels — none, read, or write — and there is no fourth. A write level

carries its read with it, because filing a document somewhere you cannot

afterwards open, search or cite is not a power anybody asked for; it is

a way to lose a document inside your own vault.

That rule runs one way only. Read never implies write: being allowed to

look inside a compartment has never been permission to put things into

it, and nothing here relaxes that direction.

A client's own administrator sets these levels, one cell at a time or a

rectangle at a time, and every change is recorded with the level the

cell held BEFORE it beside the level it holds now — so a reader can see

what changed from one record, without replaying a history to find out.

Nobody else can set them, and nobody else can see the grid.

A person who may only read still gets answersstack

Given a person who may read one compartment
And a document filed in that compartment
When they search the vault for a phrase from that document
Then the passage is among their results

A person who may only read has nowhere to file a document

Given a person who may read one compartment
When they try to file a document into that compartment
Then the vault refuses and stores nothing

Raising a person to write lets them file

Given a client administrator
And a person who may read one compartment
When the administrator raises that compartment to write
Then the person can file a document into it

Lowering a person to none takes the documents out of their listing

Given a client administrator
And a person who may read one compartment
And a document filed in that compartment
When the administrator lowers that compartment to none
Then the document is no longer in the person's listing

Twelve cells changed at once leave twelve records under one batch

Given a client administrator
And three people and four compartments
When the administrator sets all twelve cells to read at once
Then the trail holds exactly twelve records, all naming one batch

Every record names the level the cell held before

Given a client administrator
And a person who may read one compartment
When the administrator raises that compartment to write
Then the record names read as the previous level and write as the new one

Someone with no administrative authority can see nothing and change nothing

Given an ordinary person
And another person who may read one compartment
When they try to read the grid and to change that person's level
Then every attempt is refused and the level is unchanged

The vault has no fourth state, so a write cannot stand on its own

Given a person and a compartment they may not reach
When the vault is asked to record a write with no read beneath it
Then the engine refuses and the cell stays empty

A read cannot be taken out from under a standing write

Given a person who may write one compartment
When the vault is asked to remove the read alone
Then the engine refuses and the cell keeps both levels