Skip to main content

Inherited Row-Level Permissions for Notion: An n8n Automation

· 5 min read
Dan Paul
Dan Paul
Web Developer

How I solved Notion's biggest limitation for multi-client work

The Problem​

I run my entire business in Notion. Projects, tasks, meeting notes, resources, contacts, time tracking — all of it lives in one workspace using my APT (Areas, Projects, Tasks) framework.

It works beautifully. Until you add clients.

Notion lets you share individual pages with specific users. That's row-level permissions, and it's powerful. But here's the catch: it's completely manual.

Create a new task for Acme Corp? Manually add each team member to every single page they need access to. New meeting note, new resource, new project, new task? Update EVERY SINGLE PAGE! Acme hires a new person who needs visibility? Go back through hundreds of pages and add them one by one. Someone leaves? Hope you remember everywhere they had access.

For a solo operator, this is annoying. For anyone managing multiple clients with multiple users across multiple databases, it's unsustainable.

I needed inherited permissions — create a page, link it to an organization, and the right users get access automatically.

Notion doesn't have this. So I built it.

The Solution​

An n8n workflow that watches 7 databases and automatically manages a "Client Access" people property based on organization-to-user mappings.

The core logic is simple:

  1. Every content page (task, note, meeting, etc.) has an "Organization" relation
  2. A separate mapping database defines which users belong to which organizations
  3. The automation matches pages to users and keeps "Client Access" in sync

But the implementation has some nuance that makes it actually usable in production.

How It Works​

Automatic Access on New Pages​

When anyone on my team creates a new page and links it to an organization, the workflow picks it up on the next hourly run and populates the Client Access field with the appropriate users.

No manual step. No forgetting. It just happens.

Intelligent Onboarding​

This is the part I'm proudest of.

When a new client user needs access, I add them to the mapping database with a "Pending" status. On the next run, the system:

  1. Detects the pending user
  2. Scans ALL existing pages for their organization (across all 7 databases)
  3. Grants access to every historical page
  4. Automatically transitions them to "Active"

No manual backfill. A new user gets full historical access in under an hour.

Clean Revocation​

When someone leaves or loses access, I set their mapping to "Revoked." The system:

  1. Scans all pages for their organization
  2. Removes them from Client Access everywhere
  3. Transitions the mapping to "Inactive" (preserved for audit trail)

One status change. Complete removal. Full documentation of what happened and when.

Performance Optimization​

The workflow is smart about API usage:

  • Routine runs only query pages updated since the last run (incremental)
  • Full organization scans only trigger when there's a Pending or Revoked user to process
  • Deduplication prevents redundant API calls when the same page appears in multiple query results

This keeps the hourly runs fast and the API usage reasonable.

The Technical Setup​

What You Need in Notion​

Every database needs two properties:

  • Organization — Relation to your Organizations database
  • Client Access — People property for row-level sharing
  • Updated — Time property for monitoring changes

A User Access Mapping database with:

  • Notion User — People property (the user to grant access)
  • Organization — Relation (which org's pages they can see)
  • Status — Status property (Pending → Active → Revoked → Inactive)
  • Date Granted / Date Revoked — For audit trail

A Workflow State database to track the last successful run (enables incremental queries).

The n8n Workflow​

The workflow runs hourly and follows this pattern:

  1. Retrieve state — Get last run timestamp
  2. Query mappings — Get all user-organization relationships
  3. Check for special cases — Are there any Pending or Revoked users?
  4. Incremental queries — Get pages updated since last run (7 databases)
  5. Full org scans — If needed, get ALL pages for affected organizations
  6. Match and update — Sync Client Access based on mappings
  7. Update mapping status — Pending → Active, Revoked → Inactive
  8. Persist state — Save timestamp for next run

The workflow uses native Notion nodes for incremental queries (simpler) and HTTP Request nodes for full organization scans (more flexible filter construction).

For the full technical breakdown including data flow diagrams, database schemas, and configuration details, see the complete technical documentation.

What This Unlocks​

With this automation running, I can:

  • Onboard a new client user in seconds — Add one row, wait an hour, done
  • Offboard completely with one click — No hunting through databases
  • Create content without thinking about permissions — Link to org, move on
  • Maintain a complete audit trail — Who had access, when it was granted, when it was revoked
  • Scale to multiple clients — Each with their own users, all managed automatically

It's the difference between "Notion has permissions" and "Notion permissions that manage themselves."

Limitations​

A few things to know:

  • Single organization per page — If a page is linked to multiple orgs, only the first is processed
  • Hourly latency — This isn't real-time (Notion doesn't have webhooks yet)
  • Setup complexity — You need n8n running somewhere, and the workflow has ~40 nodes

This isn't a plug-and-play template. It requires understanding n8n, the Notion API, and your own database structure. But if you're already running n8n and hitting this permissions wall, the pattern is replicable.

The Bigger Picture​

This automation exists because I use my own system.

The APT template (free in the Notion Marketplace) is how I run my business. Once I started using it with clients, I hit friction. So I automated the friction away.

That's the loop: Build the system. Use it until something breaks. Fix it. Repeat.

The template is the foundation. The automation makes it enterprise-ready.

What's Next​

The full workflow architecture is documented in the technical documentation. If you're running a Notion-based operation with multiple clients and this problem sounds familiar, reach out — happy to walk through the architecture.