Sharing & permissions — Sablefort Docs

Sharing is how Keyvault gets the right secret to the right person without anyone emailing passwords around. You can share an entire vault or a single item, and you decide exactly how much each person can do with what you share.

Two ways to share

Share a vault — grant a person or group access to everything in a vault. This is the usual way to work: put team secrets in a shared vault and add the team.
Share a single item — grant access to one item without sharing its whole vault. Useful for one-off exceptions.

Prefer sharing vaults over individual items where you can — it is easier to reason about and audit. Reach for item-level sharing only for genuine exceptions.

Permission levels

Every share is granted at one of four levels. Each level includes everything the levels above it can do.

Level	Can do	Typical use
View	See item details and reveal values	Someone who needs to read a credential but not use it in automation
Use	View, plus copy and autofill without necessarily revealing values	Day-to-day users of a shared login
Edit	Use, plus create, change, and move items in the vault	Team members who maintain the vault's contents
Manage	Edit, plus invite people, set permissions, and remove access	Vault owners and team leads

Grant the least access that lets someone do their job. Most people need Use; reserve Manage for the one or two people who own each vault.

Sharing a vault

Open the vault and select Share (or Manage access).
Add a person by email, or add a group — see Teams & org.
Choose a permission level for that person or group.
Select Save. They will see the vault the next time their app syncs.

Sharing with a group is the most maintainable approach: as people join or leave the group, their access to the vault follows automatically.

Sharing a single item

Open the item and select Share item.
Add the person or group and pick a permission level.
Confirm. The item appears for them without exposing the rest of the vault.

Sharing a copy with a secure link

Sometimes you need to hand a secret to someone outside your team — a contractor or a vendor. A secure link shares a one-time, expiring copy:

Open the item and select Share via link.
Set an expiry (for example 1 hour or 1 day) and, optionally, limit it to a single view.
Send the generated link through your normal channel. Once it expires or is viewed, it stops working.

A secure link shares a copy at that moment in time. If you later change the item, the link does not update — revoke it and send a new one.

Revoking access

You can remove access at any time from the same Manage access screen:

Remove a person or group from a vault or item to end their access. It disappears from their app on the next sync.
Revoke a secure link to disable it immediately, even before it expires.
Change a level — for example downgrade someone from Edit to Use — without removing them entirely.

If a secret may have been exposed — a device is lost, or someone leaves the team — revoke access and rotate the affected credential. Removing access stops future reads, but a value that was already seen should be changed.

Seeing who has access

The Manage access view lists everyone who can reach a vault or item and at what level, including access inherited through a group. Review it periodically so shared vaults do not accumulate people who no longer need them.

Next steps

Teams & org — use groups and roles so access scales with your organization.
Security model — how sharing stays zero-knowledge end to end.