Who can do what

Who can do what

• The screen works at the scope chosen in the scope switcher. In a tenant, opening it requires metadata.read in the Tenant and changes require metadata.write there. At the platform, both are decided at the platform. The permission is checked again on every save, and a refused save says why where you pressed it.
• At the platform you design the platform catalogue: every entity, field, parent and relation made there is owned by the platform and reaches every tenant. A platform definition belongs to the platform alone: you save it without a tenant of your own, and deleting any tenant never deletes it.
• In a tenant, what you create is owned by that tenant: only that tenant sees it, in this designer, in Explorer, in imports and in its domain views; no other tenant does. The tree and each page show the owner as Tenant.
• A definition is changed only where it is defined. In a tenant you read the platform's (and your account's) entities, fields and relations, and build on them — inherit from them, relate your entities to them, decide what an inherited field becomes on your own entity, see them through domain views — but you cannot change them there: settings, valid time, fields, parents, Change inheritance and relation rules are changed at the platform.
• An account cannot own definitions yet; at account scope the screen says so.
• Without metadata.write the page says why in place of + New entity, + Add field, + Add relation to… and the forms.
• Adding a data type needs metadata.write at the platform, because it affects the whole platform; without it the data types panel says so.
• Card-language assignments are model metadata. They follow the same ownership rule as the entity or field they describe: change a platform assignment at the platform; a tenant may read and inherit it but cannot rewrite it there.

Reference records are published with metadata.write at the platform, on a platform reference entity; they are part of the model the platform publishes, not a tenant's records. A tenant reads them and never changes them: a record cannot be added to a reference entity in a tenant, and its records are shown read only with the reason.

A rule or a computed field belongs to whoever owns its entity: at the platform you add them to platform entities, and they apply in every tenant that reads the entity; in a tenant, to the tenant's own entities. A platform entity's rules are listed in a tenant with “Defined at the Platform; change it there.”

Keep in mind A definition this scope cannot change shows its values and one sentence instead of the controls: “Defined at the Platform; change it there.” (or “Defined at the Account; change it there.”). Definitions created before 26 September 2026 are owned by the platform, including those saved from a tenant, so they are changed at the platform.

Keep in mind Valid time can be switched off again under Settings. Before you save, the screen counts the records that carry a period (across every tenant at the platform, within the tenant in a tenant) and says the count. Nothing is deleted: the stored periods stay as they are, are not read or shown while valid time is off, and a new record cannot carry one. Switch it on again and they come back.