Roles
Each person has one role, from viewer up to owner, with department roles in between that are set up for your organisation. Exec and owner see every team. Owners also manage people, settings and backups.
Teams
Put people in one or more teams, and assign folders or single files to teams. Folders with no team are the shared library everyone can see. Pages made from a document follow that document’s folder.
Access is enforced everywhere: in answers, sources, search, page views and shared links.
Changes need an owner’s approval
Changing anyone’s role or team needs a code emailed to the signed-in owner. A stolen session alone cannot widen anyone’s access.