[victorsavkin]

Great question.

Polygraph knows what repos every dev (and therefore their agents) has access to. If a session touches repos you don't have access to, you'll only see the parts you're allowed to: PRs to a repo you can see, for instance. You won't see the logs or high-level descriptions, which can contain info you shouldn't see.

If a dev loses access to a repo, they also lose access to the sessions associated with it.

In other words, although Polygraph has one repo graph and one session graph under the hood, every dev has access to only a subset of each.