So far the idea was that we would make documents ephemeral by default, requiring an explicit "save" action to keep them locally. However, with the introduction of access controls we'll probably have an explicit invite/join request process. With that I think it'd be pretty weird to add people in ephemeral mode by default. Do we need to rethink this?