Access to content can be controlled by applying access right to individual users, defining accesses in policies to govern access to content based on object type, role and lifecycle state of the content, and defining rules to govern access to attributes and relationships. A person's membership in organizations and collaborative spaces (previously referred to as projects) also determines if the person can access specific content.