In everyday team work, data access is usually generous: whoever is on the project sees the project. On a board of directors, this logic does not work. Meeting documents contain trade secrets, personnel files, M&A considerations - information where the right standard is not "as much transparency as possible" but need-to-know.
The typical situations
The same constellations appear on almost every board:
- The guest for one agenda item. The head of finance presents the budget but should not see the other agenda items - neither documents nor discussion.
- The committee. Audit or nomination committees work with documents the full board should not receive.
- The external specialist. A lawyer or adviser needs exactly one dossier, not the archive.
- The auditors or the bank. They need one specific resolution evidenced - not the whole minutes.
Solving such cases with email attachments and individual grants creates two problems at once: the effort grows with every case, and nobody can say afterwards who was able to see what, and when.
Three principles that prove themselves
1. Roles and groups instead of individual grants. Define once what "member", "committee", "guest" mean, and share meetings and documents with groups. New members automatically inherit the right permissions; leavers lose them completely. This is exactly how access management in HeyEla is built.
2. The filing system knows the rights. Permissions are of little use if documents immediately leave the protected environment via download and email attachment. A document hub with integrated permission checks keeps documents where the rules apply.
3. AI answers respect the same rights. As soon as a board uses AI - for search, summaries, draft minutes - the access logic must apply there too. An AI search may only answer what the person asking would be allowed to see themselves. Ask vendors about this specifically: it is the difference between a governance tool and a data leak with a chat interface.
And in practice?
Getting started is unspectacular: list the roles that actually exist on your board (members, committees, secretariat, recurring guests), define them cleanly once - and check once a year whether reality still matches the rights. In group and holding structures there is one more layer: rights must follow the corporate structure. We wrote a separate article about this: Organising board meetings in holding structures.
How it all works together - from the annual plan to the action item - is shown in our walkthrough running board meetings digitally.
Conclusion
Access rights on a board are not an IT detail, they are governance. Define roles cleanly once and you save yourself hundreds of individual decisions - and can prove at any time that confidential matters stayed confidential.