Ownership-Based Permissions

ICDB ships with cluster governance open: anyone on your tenant can extend anyone’s cluster. That is the right default for a team of three who trust each other, and it means nothing is in your way on day one.

When you outgrow it, ownership is a switch, not a migration. Move a cluster to members only and just its contributors can edit; move it to review required and the owner approves every attribution and edit before it lands. The analyst closest to the work decides how tightly it is held.

This is deliberately different from the top-down access control most platforms use, where an administrator sets everyone’s visibility up front. Combined with TLP markings on every piece of shared data, it lets sensitive investigations stay private without forcing that ceremony onto the ones that do not need it.