Access control

Access control in Truke KF is based on labels — short text tags assigned to both users and items.

Labels

Item A: Alice can read and edit it. Bob cannot see it.
Item B: Both Alice and Bob can see it. Neither can edit it.
Item C: Everyone can see it and edit it.

A label is a plain text tag, for example `staff`, `beta`, or `finance`. Labels are case-sensitive.

Labels on items can carry a qualifier:

Label	Meaning
`finance`	Read access for users with the `finance` label
`finance:w`	Read and write access (including deletion) for users with the `finance` label

Rules

An item with no labels is visible and editable by everyone.
An item with labels is visible to a user if they share at least one label with the item.
An item is editable and deletable by a user if they share at least one label with the item that carries `:w`.

When a subitem is created, it inherits the labels of its parent by default. This can be changed at creation time.