Decision Frameworks

When to use which pattern for member lists, invites, share dialogs, access-denied pages, role definitions, and removal—backed by 152 instances.

Have questions about Permission & Access Control?

Get instant answers from our AI assistant. Trained on our research data from leading enterprise systems.

Framework 1: Member List
Framework 2: Invite Flow
Framework 3: Share Dialog
Framework 4: Access Denied
Framework 5: Role Definitions
Framework 6: Removing Access
Quick Reference

Introduction

Permission design requires six decisions: how to present your member list, how to handle invites, how to build share dialogs, what to show when access fails, how to communicate roles, and how to handle removal. These frameworks give you the consensus answer for each, backed by what 10 enterprise systems actually ship.

Framework

Permission Design Frameworks: Data-Backed Guidelines for Every Permission Surface | Northbase

Element	Recommendation
Layout	Table with name, email, role, status
Primary CTA	"Invite" (not "Add")
Segmentation	Tabs or sidebar sections
Pending invites	Inline with badge (Figma, Linear) or separate tab (GitHub, Airtable)
Seat limits	Show on member list if plan-gated (3 of 10 do this)

Pattern	Frequency	Examples
"Invite [noun]"	8 of 10	"Invite users" (Figma), "Invite people" (Slack), "Invite member" (GitHub)
"Add [noun]"	1 of 10	"Add members" (Notion)

Element	Recommendation
Input	Email field supporting comma-separated addresses
Role selector	Dropdown with 1-2 sentence descriptions per role
Message field	Optional — 4 of 10 include it (Notion, Dropbox, Asana, Trello)
CTA	"Send invite" or "Invite"
Email	Personal framing: "[Name] invited you to [workspace]"
Accept CTA	"Accept invite" (not "Sign up" or "Create account")

Element	Recommendation
Container	Popover or modal attached to "Share" button
Sections	Email invite + current access list + visibility selector
Visibility	3 tiers: Private → Workspace → Public
Default	Most restrictive ("Only people invited")
Secondary CTA	"Copy link"
Permissions per person	Dropdown: "Can edit" / "Can view"

Tier	Notion	Figma	Dropbox
Private	Only people invited	Only those invited	Only you
Org	Everyone at [workspace]	Anyone at [org] with the link	Team members
Public	Anyone on the web with link	Anyone with the link	Anyone with link

Element	Recommendation
Headline	Direct: "No access to this page" (not technical: "Authentication error")
Body	Explain the recovery path: "You can access this page if someone approves your request"
Primary CTA	"Request access"
Secondary CTA	"Back to my content" or "Switch account"
Account context	Show logged-in email + account switch option

Approach	Example	Tone
Direct (recommended)	"No access to this page" (Notion)	Clear
Soft	"It looks like you don't have access to this" (Asana)	Friendly
Technical (avoid)	"Authentication error" (Linear)	Cold
Hidden (security use case)	"404" (GitHub)	Intentionally vague

1. Member List	Table + "Invite" CTA + tabs	8 of 10
2. Invite Flow	Email input + role selector + "Send invite"	7 of 10
3. Share Dialog	Popover + 3-tier visibility + "Copy link"	5 of 6
4. Access Denied	Recovery path + account context	4 of 7
5. Role Definitions	Inline dropdown with descriptions	7 of 9
6. Removing Access	"Remove" + question headline + consequences	6 of 9

Decision Frameworks

Have questions about Permission & Access Control?

Table of Contents

Introduction

Decision Frameworks

Have questions about Permission & Access Control?

Table of Contents

Introduction

Framework 1: Member List

Framework 2: Invite Flow

Framework 4: Access Denied

Decision Frameworks

Have questions about Permission & Access Control?

Table of Contents

Introduction

Decision Frameworks

Have questions about Permission & Access Control?

Table of Contents

Introduction

Framework 1: Member List

Framework 2: Invite Flow

Framework 3: Share Dialog

Framework 4: Access Denied