> ## Documentation Index
> Fetch the complete documentation index at: https://docs.denari.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Access & permissions

> Who can publish, who can open a portal, and what Portals does not do yet.

## Turning Portals on

Portals is a firm-level component. When it's enabled:

* **Portals** appears in the product switcher.
* **Publish to client** and **Open client portal** appear in the Documents actions menu.
* The **Published to client** marker and filter appear in the Documents list.
* A **Clients** tab appears in **Admin**.

When it's off, all of that is hidden — not disabled-looking, just absent — and no document is treated as published. If you expect to see Portals and don't, contact the Denari or IT admin at your firm.

**Document requests** and **request templates** sit behind a second flag, so a firm can have Portals without them.

## Who at your firm can publish

Portals inherits the client entity access rules used everywhere else in Denari, so there's no separate permission list to maintain.

* Everything is scoped to your firm. You can never publish to, or open, another firm's entity.
* If a client entity is **locked**, only its members can publish to or open its portal. Everyone else gets an access-denied error.
* Administrator status does **not** override an entity lock. Only Denari super users bypass it.

Locking the entity is therefore how you restrict a sensitive client's portal to a named team. See [Roles & permissions](/general/roles-and-permissions).

## What clients can reach

A client sees a document only when it's published to a portal for one of their **active** entity grants — nothing else, ever. Their view is computed server-side from those grants, not from anything the browser sends.

Two rules hold no matter how a request is made:

1. **A tagged document can only be published to one of its own client entities.** The picker only offers them, and anything else is rejected.
2. **The document must belong to your firm and still exist**, re-checked at the moment of publishing.

Failures are deliberately vague — a document that isn't yours and one that isn't tagged to that entity return the same "not found", so the API can't be used to probe what exists.

## What Portals does not do yet

Worth knowing before you describe Portals to a client:

* **Nothing auto-approves.** Every file a client sends lands in your [intake queue](/documents/intake) for review. Tighter automation is on the roadmap.
* **No notifications.** The invitation is the only email Denari sends by itself. Publishing a document or creating a request notifies nobody.
* **No firm-wide view of outstanding requests.** You review them one portal at a time. See [Document requests](/portals/requests).
* **Status updates aren't live.** You and the client read the same status, but each side sees a change on its next page load.
* **No comments or messaging in a portal.** Collaboration stays in [Documents](/documents/getting-started).

<Warning>
  Publishing is reversible, but disclosure isn't. Unpublishing removes a
  document going forward; it cannot retract a file already downloaded.
</Warning>

## Getting help

Stuck? Email [support@denari.com](mailto:support@denari.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.