[adityamishra-hydradb]

For humans

Documents the public ACL inheritance contract from ENG-3302.

The access-control guide and metadata references now explain acl_inherit: true, its widening risk, upload refusal, exclusivity with acl, and last-writer-wins behavior.

In one line: API users can distinguish private revocation from explicit connector-resource inheritance.

For agents

• acl: [] and acl: null remain private revocations.
• acl_inherit: true removes a connector document's own ACL.
• acl and acl_inherit cannot appear together.
• Uploads and sources without connector resource attribution are refused.
• Connector syncs can replace manual ACL writes because ACL updates are last-writer-wins.

Testing

• pnpm hygiene:strict — passed.
• pnpm mintlify validate — passed.
• No staging or production system was called, read, or written.

Merge order

1. Application PR.
2. Dashboard PR.
3. This documentation PR: merge after the app change reaches prod.

Related pull requests

• Application: https://github.com/hydra-db/hydradb-application/pull/2978
• Dashboard: https://github.com/hydra-db/dashboard-2.0/pull/765
• Documentation: docs(acl): explain inherited document permissions (ENG-3302) #338

Decisions taken without review

• Document inheritance as a separate field, because empty ACL remains private.
• State that inheritance can widen access, because the resource ACL can be broader.
• State last-writer-wins behavior, because provider updates can replace manual ACL changes.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
cortex-ai	🟢 Ready	View Preview	Oct 27, 2026, 11:30 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[github-actions]

✅ Mintlify Hygiene

No issues found.

[adityamishra-hydradb]

@greptileai review

[adityamishra-hydradb]

/devin review

[devin-ai-integration]

Starting Devin Review.

[openhack-agent]

✅ OpenHack Summary

Security review of docs(acl): explain inherited document permissions (ENG-3302). 4 changed files; 0 findings at or above the low reporting threshold.

0   0   0   0

Confidence Score: 5/5

No reportable security findings were detected in this scan.

Security merge-readiness rubric: 1 = critical, 2 = high, 3 = medium, 4 = low, 5 = no reportable findings. This score reflects scan findings, not a guarantee of correctness or complete coverage.

Files Needing Attention: None

Important Files Changed

• api-reference/v2/endpoint/update-source-metadata.mdx (modified)
• api-reference/v2/openapi.json (modified)
• essentials/v2/access-control.mdx (modified)
• essentials/v2/metadata.mdx (modified)

Last reviewed commit: fcba7a1 · View review on OpenHack

---

TIP: Mention @openhack-agent in a PR comment to request a review or ask a question. Use @openhack-agent fix all for every finding, or @openhack-agent fix unresolved threads for open review threads only.

[openhack-agent]

OpenHack reviewed this commit. See the OpenHack Summary for the confidence score and fix actions.

[adityamishra-hydradb]

@greptileai review

[adityamishra-hydradb]

/devin review

[devin-ai-integration]

Starting Devin Review.

[adityamishra-hydradb]

This PR is replaced by #341. The replacement contains the same changes in one DCO-signed commit. I did not force-push this branch.

[greptile-apps]

Confidence Score: 5/5

[Low impact] This documentation PR appears safe to merge after the application change reaches production, as the PR requires.

Summary

Documents how to remove a document’s ACL override and resume its connector resource permissions, as requested by ENG-3302.

• Connector documents can return to their resource permissions with acl_inherit: true.
• OpenAPI descriptions show placeholder brackets and query separators directly.

No actionable issues were found.

_{Reviews (1) · Last reviewed commit: "docs(acl): expose inheritance in the API..." · Reviewed by Greptile}