Confluence Cloud Teams
You set up confluence cloud teams by creating groups in your central admin directory. Next, you link those groups to specific wiki spaces so people can read pages. Most companies start by putting every worker into one large default group. That quick choice grants broad read and write rights across all internal folders. Soon, interns and outside contractors can see private architecture plans and production notes. Overly broad roles also expose sensitive keys and customer details stored inside old
Slack / Teams Security Notifications: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up confluence cloud teams by creating groups in your central admin directory. Next, you link those groups to specific wiki spaces so people can read pages. Most companies start by putting every worker into one large default group. That quick choice grants broad read and write rights across all internal folders. Soon, interns and outside contractors can see private architecture plans and production notes. Overly broad roles also expose sensitive keys and customer details stored inside old docs.
How confluence cloud teams and space permissions work
The platform separates user groups from the team labels used for page mentions. A team label lets you tag five or ten coworkers in a comment. Still, true read and write rules depend on directory groups and space permissions. Admins first build groups inside the central user directory or link an identity provider. Those directory groups sync over to the wiki and attach to individual spaces. Each space acts like a locked cabinet with its own rule list.
Inside a space, admins grant actions like viewing, adding pages, or deleting comments. You can also place restrictions on a single page to block wider groups. Page rules follow a strict hierarchy within the folder tree. View locks pass down to every child page below the parent document. Edit locks apply only to the current page, leaving child pages open. Understanding this difference prevents accidental leaks when staff move pages between folders.
Where native wiki permissions fall short for engineering workflows
Native directory groups work well for deciding which human can log in. They keep sales staff out of engineering drafts and protect board notes. Yet modern engineering teams do not just read wiki pages in a browser. Developers connect bots, search scripts, and AI assistants to pull context from docs. They generate API tokens tied to their own user accounts to run scripts.
Once a script holds a user token, it inherits every space permission. Native space rules only check who owns the token at login time. They do not inspect what individual requests or queries fetch in flight. If a support page holds customer emails or card numbers, the script pulls them. If an incident postmortem includes phone numbers or national IDs, bots index them.
Slack / Teams Security Notifications: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Managing API tokens and automated reads across spaces
Static API tokens create another blind spot for security and platform leads. Engineers often share a single token across several build jobs and local tools. When an app reads a page, the audit log shows the token owner. You cannot tell which local script or terminal session actually made the call. Revoking a leaked token breaks every script that relies on that account.
To reduce risk, admins often try to create separate service accounts per project. They assign each bot account to a tiny group with one space role. That manual process takes hours to set up and audit every month. Developers get tired of waiting for approvals and go back to personal keys. Teams need runtime controls that inspect requests and mask sensitive fields in results.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev sits inline in the protocol beside each supported service as an open-source proxy, a sidecar for your database or API. For every query or command an AI agent or engineer runs against production, hoop.dev decides to pass, mask, block, or hold it for human approval.
First, hoop.dev guardrails block banned queries before they run or hold risky ones for review, and hoop.dev data masking rewrites matched sensitive values in responses in memory. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What is the difference between a team and a user group?
A team is a casual group used to tag coworkers on wiki pages. A user group is an admin object that controls space permissions and roles.
Do page view rules apply to child pages?
Yes, view locks pass down to all child pages under the parent page. Edit locks do not pass down, so you must lock each child page.
How do API tokens interact with space permissions?
An API token carries the exact same space rights as the user owner. Any script using that key can read or change every allowed page.