Core concepts

Three ideas shape how Prosopia handles access and visibility. Understanding them makes the rest of the documentation straightforward.

Identity: the ORCID iD is the proof

A profile is keyed on a canonical ORCID iD. When you log in with ORCID and your iD matches a profile’s, the match is the proof of ownership — no operator approval, no challenge. This is why claiming is self-verifying.

Two login providers are supported: ORCID (the primary path — its subject is the ORCID iD, so only an ORCID login can self-claim) and Google OIDC (can be made an editor or given a permission, but cannot self-claim because it carries no ORCID iD).

Ownership, management, and permissions

Three separate things, each with one home:

• Ownership is one row per profile: one person owns it. Written in the same transaction that creates or claims it, so there is never a moment when a profile exists but nobody owns it.
• Management is per profile and people-only. The owner can add a co-owner (everything the owner may do except transfer) or an editor (rewrite the document; cannot publish, delete, or manage access).
• Permissions are per person, not per profile. A permission says a principal — a person (from a session cookie) or a consumer app (from an API key) — may read or write everything the granting person holds: every profile they own and every lens they wrote. All-or-nothing: there is no lab-only permission, and a read permission is a whole read. write implies read.

The operator token is deliberately not a principal — it cannot publish, grant, or take ownership.

Visibility: tiers and publication

There is no “make this public” toggle. Visibility is decided per artifact, per caller, on every read, through two controls:

1. Viewer tier. Each caller resolves to a tier (public, internal, or restricted) based on their credential, whether they own or manage the profile, and any permission its owner gave them. The tier engine projects each artifact down to what that caller may see.

2. Publication floor. A profile whose owner has not published it is capped at internal, no matter what the document declares. A stranger sees nothing until the owner publishes.

Signing in is not a privilege. A logged-in person with no permission from a profile’s owner sees exactly what the open web sees. Access comes from a permission or a key, never from merely having an account.

Publication is consent, not a content change. It is a separate, recorded, revocable act that only the person the profile describes can perform. No ingest path, migration, or bulk import can publish anyone — the schema enforces this structurally. Unpublishing narrows visibility (back to internal) but does not black out: permission holders and lab consumers keep reading as they always could.

Paper full text sits at a hard floor that nobody can lift — not the owner, not the operator, not any permission or key tier.