Most Notion permission failures are not bugs. Notion grants each person the broadest level of access they hold from any source, and every subpage inherits from its parent by default. So a page you thought was locked down is usually shared through a teamspace, a parent page, or a workspace-wide setting nobody remembers turning on.
The broadest-access rule explains most of it
Notion documents this behaviour plainly: it respects the broadest level of access given to a user. Set someone to Can view on a page, then later give everyone in the workspace Full access to that same page, and your restriction quietly evaporates. The person is a workspace member, so the wider grant wins.
The practical consequence is that lowering one person’s level does almost nothing on its own. Before you decide a permission is broken, read the Share menu from top to bottom: the individual, any group they belong to, the teamspace it lives in, and the General access row. The strictest setting there is decorative if a looser one sits above it.
What each permission level actually allows
| Level | Can edit? | Can share? | Where it appears |
|---|---|---|---|
| Full access | Yes | Yes | Any page |
| Can edit | Yes | No | Any page |
| Can edit content | Page content and property values only, not structure, views, sorts or filters | No | Database pages only |
| Can create | Can create new pages, cannot view or edit existing ones they were not granted | No | Database pages, Business and Enterprise only |
| Can comment | No | No | Any page |
| Can view | No | No | Any page |
Can edit content and Can create are the two levels people miss most often, and both only surface on database pages. If a contributor is wrecking your database structure while set to Can edit, the fix is not a new group or a duplicate database. It is switching them to Can edit content. If they should submit tickets without reading anyone else’s, Can create is the level you want, and it requires Business or Enterprise. Full definitions live in Notion’s sharing and permissions documentation.
Symptom, cause, fix
| What you see | Likely cause | Fix |
|---|---|---|
| Cannot add an external email as a guest | Guest limit reached, guests disabled for the workspace or teamspace, or the domain is not allowed | Check guest count against your plan, then Security settings, then allowed domains |
| Guest arrived as a billable member | Workspace is above its guest limit and their email matches an allowed or verified domain | Remove unused guests or move to a plan with a higher limit |
| Someone sees a subpage you never shared | Subpages inherit parent permissions | Open the subpage and override the permission there |
| Member edits a page set to Can view | A broader grant via workspace, group or teamspace | Remove the wider grant, not just their row |
| Page moved to Private, subpages still visible | The Private override applies to the parent page only | Fix each subpage’s Share menu individually |
Integration returns object_not_found | The connection was never added to that page | Add the connection from the page’s ••• menu |
| Export option has vanished | Disable Export is on in Security settings | An admin turns it off on desktop |
When you cannot share a page with a guest
Notion lists three reasons a guest invite will not go through: the workspace has hit its guest limit, guests have been blocked at the workspace or teamspace level, or the invitee’s email domain is not an allowed domain. Work through them in that order.
- Open Settings, then Members or People depending on your plan, and select the Guests tab to count current guests.
- Compare that against your plan. The Free plan caps external guests at 10; Plus, Business and Enterprise are listed as unlimited on the Notion pricing page.
- If you are over the limit, remove guests who no longer need access, or change plan.
- Check Settings, then Security, for guest restrictions. On Enterprise, if Allow members to invite guests to pages is off, only workspace owners can invite anyone.
- Check Allowed email domains under Settings. A domain listed here converts matching people into members automatically rather than guests.
- When you do invite, select Skip for now at the membership prompt. That is the step that keeps the person a guest instead of a member.
Guests themselves are free of charge according to Notion’s pricing FAQ, and they only reach the individual pages they are invited to. The billing risk is conversion, not the guests. Once you are over the limit, new people sharing your workspace’s email domain get added as members, and members are paid seats. Notion’s guide to managing members and guests covers the roles involved: workspace owner, membership admin, member, and time-limited temporary members for Marketplace consultants, which do not consume a paid seat.
Why a page you made private is still visible
Two inheritance behaviours cause this, and they work in opposite directions.
First, a subpage created inside a page takes on that parent’s permissions. Nobody explicitly shared the subpage, so nobody thinks to check it. Second, and more surprising, dragging a shared page into your Private sidebar section removes everyone else’s access to that page but leaves its subpages exactly as they were. The lockdown does not cascade.
- Open the parent page and select Share to confirm who currently has access.
- Open each subpage in turn and select Share there. Do not assume the parent’s state applies.
- Use the dropdown beside each person, group or teamspace and select Remove.
- Set General access to Only people invited if the page should not be reachable by search or link.
Public links leak in ways that are easy to miss too. A page set to Anyone on the web with link can be reached without the link if it is mentioned from a page shared more broadly, nested inside one, or connected by a two-way relation to one. That last case catches teams who build interconnected systems, so review sharing whenever you wire up relations and rollups across databases.
Teamspace defaults decide more than the Share menu does
Pages inside a default teamspace are accessible to everyone in the workspace. That is the design, not a misconfiguration, and it is the most common reason a supposedly restricted page turns up in a colleague’s search.
- Select ••• beside the teamspace name in your sidebar.
- Select Teamspace settings.
- Open the Members tab and look at Permissions. The word Default confirms every workspace member is in it.
- Open the Permissions tab to see the teamspace type: Open means anyone can join and view, Closed means everyone can see it exists but must be invited, and Private hides it entirely from non-members.
Private teamspaces require Business or Enterprise. On Free and Plus, Closed is the strongest option available, and Closed still advertises that the teamspace exists. Teamspace owners can also set default permissions applied to every new page created inside, which then has to be changed page by page afterwards. Getting that default right before a rollout saves considerable cleanup, which is the main argument for planning Notion’s teamspace structure for a whole team up front rather than retrofitting it.
One more plan-gated limitation: teamspace-level Disable guests, Disable export and Disable publishing sites, forms and public links are Enterprise-only controls. On Business you can create private teamspaces, but you cannot stop guests being added to a specific one.
Restricting a database so people only see their own rows
Database page-level access is Business and Enterprise only, and it needs a person property or a created by property to key off.
- Open the source database, not a linked view of it.
- Select Share at the top of the database.
- Under Page-level access, select Add a new rule.
- Choose the person or created by property the rule should follow.
- Choose an access level, then select Create rule.
Two things routinely trip people up here. Someone granted access only through a page-level rule and given nothing on the database itself will hit an error opening the database directly. They reach their page from the inbox notification, or through a linked view you share with them. And because that person cannot create new pages in the database, submissions have to arrive through a Notion form pointed at the database. If the database renders empty rather than blocked, that is a different problem entirely and worth separating from permissions before you start editing rules; see troubleshooting a Notion database that will not load.
When the blocked party is an integration, not a person
Connections built on the API run on their own permission system. Your own access to a page grants the connection nothing.
- Open the page and select ••• at the top right.
- Select Add connections at the bottom of the menu.
- Search for the connection and select it.
- Repeat for any child pages the integration needs, since access does not always reach everything nested below.
On Enterprise, workspace owners can restrict which connections members may install and control page access centrally through Settings, then Connections, then the Manage tab. If a connection is missing from the catalogue, that restriction is usually why. Permission gaps are also the first thing to rule out when scheduled jobs stop firing, whether that is a Notion and Slack connection going quiet or database automations that stopped running.
Asking for access rather than chasing an admin
If you open a page you cannot read, select No access on the page to send a request to its creators or editors. If you already have view or comment access and need more, select Share, open the dropdown showing your current level, and select Request edit access. Page owners approve or reject these from their Inbox. Refresh the page if editing does not become available immediately after approval.
Non-member access requests are enabled by default on every plan except Enterprise. Plus and Business workspaces can switch them off under Settings, then Security, using Allow page access requests from non-members. Free workspaces cannot turn this off at all, which is a genuine reason not to keep sensitive client work on a Free plan.
Frequently asked questions
Why can a member still edit a page after I set them to Can view?
Because Notion applies the broadest access a person holds. If the workspace, a teamspace, or a group they belong to carries a higher level on that page, the individual setting is overridden. Open the Share menu and lower or remove every wider grant, not just that person’s row.
Do guests cost money in Notion?
No. Notion’s pricing page states guests are free of charge and can only reach the individual pages they are invited to. The cost risk is conversion. Once you pass your plan’s guest limit, people whose email matches your workspace domain are added as billable members instead.
Why does my guest invite fail for an external email?
Three causes account for nearly all of them. The workspace has hit its guest limit, guests have been disabled for the workspace or teamspace, or the person’s email domain is not an allowed domain. Check the guest count first, then security settings, then the domain rules.
Does moving a page to Private hide its subpages too?
No. Dragging a shared page into the Private section removes everyone else’s access to that page only. Notion states the override does not cascade, so permissions granted on subpages stay exactly as they were. Open each subpage’s Share menu and remove the old grants individually.
Why does my integration get object_not_found on a page I can see?
Connections follow their own permission system, and your access does not extend to them. Open the page, select the ••• menu, choose Add connections, and pick the integration. Child pages that were never shared with the connection keep returning that error until they are added as well.
Sponsored
