X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/364fed6e1d4036719e4c461cfe0bc24e7f52f144..ccfad8f850f6d3edc43e7757fbeed112864efd18:/doc/api/permission-model.html.textile.liquid

diff --git a/doc/api/permission-model.html.textile.liquid b/doc/api/permission-model.html.textile.liquid
index d70430a430..7ee179071a 100644
--- a/doc/api/permission-model.html.textile.liquid
+++ b/doc/api/permission-model.html.textile.liquid
@@ -1,9 +1,14 @@
 ---
 layout: default
-navsection: api
+navsection: architecture
 navmenu: Concepts
 title: "Permission model"
 ...
+{% comment %}
+Copyright (C) The Arvados Authors. All rights reserved.
+
+SPDX-License-Identifier: CC-BY-SA-3.0
+{% endcomment %}
 
 * There are four levels of permission: *none*, *can_read*, *can_write*, and *can_manage*.
 ** *none* is the default state when there are no other permission grants.
@@ -24,7 +29,7 @@ h2. Ownership
 ** A "role" is a subtype of Group that is treated in Workbench as a group of users who have permissions in common (typically an organizational group).
 * To change the @owner_uuid@ field, it is necessary to have @can_write@ permission on both the current owner and the new owner.
 
-h2. Permission links
+h2(#links). Permission links
 
 A link object with
 
@@ -59,10 +64,14 @@ h2. Special cases
 * *can_read* on a Collection grants permission to read the blocks that make up the collection (API server returns signed blocks)
 * If User or Group X *can_FOO* Group A, and Group A *can_manage* User B, then X *can_FOO* _everything that User B can_FOO_.
 
-h2. System user and group
+h2(#system). System user and group
 
 A privileged user account exists for the use by internal Arvados components.  This user manages system objects which should not be "owned" by any particular user.  The system user uuid is @{siteprefix}-tpzed-000000000000000@.
 
 h2. Anoymous user and group
 
 An Arvado site may be configued to allow users to browse resources without requiring a log in.  In this case, permissions for non-logged-in users are associated with the "anonymous" user.  To make objects visible to the public, they can be shared with the "anonymous" group.  The anonymous user uuid is @{siteprefix}-tpzed-anonymouspublic@.  The anonymous group uuid is @{siteprefix}-j7d0g-anonymouspublic@.
+
+h2. Example
+
+!(full-width){{site.baseurl}}/images/Arvados_Permissions.svg!