Standard access has two independent dimensions. Visibility controls which employees can read the Standard inside the organization. Exposure controls whether an approved non-personal read lane may serve it beyond ordinary member sign-in.
Visibility
Who can read inside the organization.
- Organization-wide or Role-scoped
- Uses responsibility Roles
- Applied to internal retrieval
- Readers still need membership
Exposure
How far the Standard may be served outside per-user authentication.
- Internal by default
- Open only for the org-key lane
- Never makes a Role-restricted Standard public
- Does not reach an anonymous visitor
Limit by Role
Choose Role-scoped visibility when only the holders of particular Roles should read the rule. A reader sees it only if they directly hold one of the selected Roles, or the owner Role — visibility does not follow the Role tree, so holding a parent Role grants nothing from its children.
Keep broad rules organization-wide
Do not restrict a rule merely because one Role owns it. Ownership says who is accountable; visibility says who may read. A centrally owned policy can still apply to everyone.
Use exposure carefully
Open exposure is for the organization-key read lane. It is refused when a Standard is Role-restricted because those two decisions contradict each other. An anonymous visitor does not read Standards at all — not through this lane and not through any other.
Check the result
Test with a reader who should have access and one who should not. The safest access model is the smallest rule you can explain clearly, not a collection of exceptions.