Update change log and documentation for new release.

Author: ivan-kovatchev

docs/triply-db-getting-started/reference/index.md

@@ -11,10 +11,13 @@ Access Levels can be specified for the following content:
 - Datasets, including everything that exist at the dataset level, such as metadata, settings, graphs, and services.
 - Queries
 - Stories
+- Groups
 
 ### Access level control
 
-The Access Level control (see [Figure 1](#fig-access-level-control)) is available on the settings page for these content types. The Access Level control also appears on the create dialog for these content types. The standard Access Level is always "Private". An explicit user action is needed to set the Access Level to "Internal" or "Public".
+The Access Level control (see [Figure 1](#fig-access-level-control)) is available on the settings page for datasets, queries, and stories. The Access Level control also appears on the create dialog for these content types. The standard Access Level is always "Private". An explicit user action is needed to set the Access Level to "Internal" or "Public".
+
+Groups behave differently: they are "Public" by default, and their Access Level is currently set through the [API](../../triply-api/index.md) or [TriplyDB.js](../../triplydb-js/group/index.md#groupupdatemetadata-object) rather than through this control. See [Access Levels for groups](#access-levels-for-groups).
 
 <figure id="fig-access-level-control">
   <img src="../../assets/access-level-control.png">
@@ -41,9 +44,29 @@ The following table contains the meaning of the Access Levels for content that b
 
 Access Levels cannot be specified for the following content. This means that this content is always publicly accessible:
 
-- Groups, including their metadata and members.
 - Users, including their metadata.
 
+### Access Levels for groups
+
+Next to the Access Levels of the content it owns, a group has an Access Level of its own. It determines who can find the group in the list of accounts and open its page:
+
+| **Icon**                       | **Access Level** | **Meaning**                                                                       |
+| ------------------------------ | ---------------- | --------------------------------------------------------------------------------- |
+| ![](../../assets/private.png)  | Private          | The group is only visible to its members.                                         |
+| ![](../../assets/internal.png) | Internal         | The group is visible to anyone who is logged into the same TriplyDB environment.  |
+| ![](../../assets/public.png)   | Public           | The group is visible to anyone on the Internet.                                   |
+
+Groups can be nested: a group can contain subgroups. Membership is inherited downwards, so a member of a group is also a member of every subgroup below it, with the same role.
+
+Unlike datasets, queries, and stories, a newly created group is "Public" by default. A newly created subgroup instead takes the Access Level of its parent group. Changing the Access Level of a group requires the "Manage group" permission (see [Roles](#roles)), and is done through the [API](../../triply-api/index.md) or [TriplyDB.js](../../triplydb-js/group/index.md#groupupdatemetadata-object).
+
+A group that you are not allowed to see is indistinguishable from a group that does not exist: opening its page gives the same "not found" result. If you are a member of a group nested below it, you do see its name and avatar — its name is part of your own group's name anyway — but not its members, content, or settings.
+
+Two rules keep the Access Level of a group consistent with its surroundings:
+
+- **A group caps the content it owns.** The datasets, queries, and stories owned by a group can never be more accessible than the group itself. Making a group stricter therefore fails as long as it still owns content that is more accessible; that content must be changed first.
+- **A subgroup can never be more accessible than its parent group.** Making a parent group stricter fails as long as it still has a more accessible subgroup.
+
 ### Access Level dependencies
 
 The Access Levels for datasets, queries, and stories may affect each other. For example, a public query may use a private dataset. This means that visitors who are not logged in, can see the query, its metadata, and its query string; however, such visitors will never receive query results from the private dataset. This ensures that private content always stays private, as intended.

docs/triplydb-changelog/index.md

@@ -6,6 +6,25 @@ path: "/docs/triplydb-changelog"
 [TOC]
 
 
+## 26.8.100 {#26.8.100}
+
+**Release date:** 2026-08-05
+
+**Features**
+
+- `#12498` [Access Control] Groups now have an access level — `public`, `internal`, or `private` — just like datasets. The access level determines who can find the group in account listings and open its page, and it caps the access level of the datasets, queries, stories, and subgroups that the group owns. New groups are `public` by default, and a subgroup takes its parent's access level and can never be more open than its parent. The level is set through the API or with the `accessLevel` key in [TriplyDB.js](https://docs.triply.cc/triplydb-js/group/), when creating, ensuring, or updating a group; see [Access Levels for groups](https://docs.triply.cc/triply-db-getting-started/reference/#access-levels-for-groups).
+- `#11638` [SPARQL] The query optimizer now interleaves operations across independent parts of a join, instead of running each part to completion before starting the next. This produces cheaper query plans in some cases; queries are never slower and are sometimes faster.
+- [Data Upload] Each URL in a "download from URL" job can now carry its own HTTP headers, so data can be imported from sources that require for example an `Authorization` header. Requests that point at the TriplyDB instance itself automatically reuse the caller's own authorization, and need no header of their own.
+
+**Issues fixed**
+
+- `#13056` [Insights] Viewing the class-frequency diagram for a graph with no classes (or more classes than the supported limit) could throw an error instead of showing an empty chart.
+- `#11548` [Data Model] The schema view could show a redundant `rdfs:subClassOf` edge alongside the `owl:equivalentClass` edge between the same two classes.
+- `#11433` [API] Requests in progress during a scheduled deploy or maintenance window could occasionally fail with a transient server error.
+- [Query Jobs] A completed `select` query job's downloaded results reported one more result row than it actually contained, because the JSONL header line was counted as a row.
+- `#12858` `#12859` [SPARQL] The query planner underestimated the cost of property paths and of aggregates, because it treated variables that only become bound by the operation itself as already bound. This could result in a suboptimal join order.
+
+
 ## 26.7.200 {#26.7.200}
 
 **Release date:** 2026-07-21

docs/triplydb-js/group/index.md

@@ -216,6 +216,30 @@ Inherited from [`Account.setAvatar(file: string)`](../account/index.md#accountse
 <a id="organizationupdatemetadata-object"></a>
 ## Group.update(metadata: object)
 
-Updates the metadata for this account.
+Updates the metadata for this group.
 
-Inherited from [`Account.update(metadata: object)`](../account/index.md#accountupdatemetadata-object).
+Inherited from [`Account.update(metadata: object)`](../account/index.md#accountupdatemetadata-object), and next to the keys documented there the metadata object also accepts a key that only applies to groups:
+
+<dl>
+  <dt><code>accessLevel</code></dt>
+  <dd>
+    <p>The access level of the group, which determines who can find the group and open its page. The following values are supported:</p>
+    <dl>
+      <dt><code>'private'</code></dt>
+      <dd>The group can only be seen by its members.</dd>
+      <dt><code>'internal'</code></dt>
+      <dd>The group can be seen by people who are logged into the same TriplyDB instance.</dd>
+      <dt><code>'public'</code></dt>
+      <dd>The group can be seen by everybody on the Internet.</dd>
+    </dl>
+    <p>Changing the access level requires the "Manage group" permission. The change is rejected when the group would end up more accessible than its parent group, or stricter than a dataset, query, story, or subgroup that it owns — lower the access level of that content first. See <a href='../../triply-db-getting-started/reference/index.md#access-levels-for-groups'>Access Levels for groups</a> for details.</p>
+    <p>Requires TriplyDB API version 26.8.100 or greater; setting it against an older instance throws an <code>IncompatibleError</code>.</p>
+  </dd>
+</dl>
+
+### Examples
+
+```ts
+const group = await triply.getGroup('my-group')
+await group.update({accessLevel: 'internal'})
+```

docs/triplydb-js/user/index.md

@@ -73,6 +73,21 @@ This method requires an API token with write access for this user.
 - The optional `metadata` argument can be used to specify additional metadata. This is a dictionary object with the following optional keys:
 
 <dl>
+  <dt><code>accessLevel</code></dt>
+  <dd>
+    <p>The access level of the group, which determines who can find the group and open its page. The following values are supported:</p>
+    <dl>
+      <dt><code>'private'</code></dt>
+      <dd>The group can only be seen by its members.</dd>
+      <dt><code>'internal'</code></dt>
+      <dd>The group can be seen by people who are logged into the same TriplyDB instance.</dd>
+      <dt><code>'public'</code> (default)</dt>
+      <dd>The group can be seen by everybody on the Internet.</dd>
+    </dl>
+    <p>A subgroup defaults to the access level of its parent group instead of to <code>'public'</code>, and can never be more accessible than its parent. See <a href='../../triply-db-getting-started/reference/index.md#access-levels-for-groups'>Access Levels for groups</a> for details.</p>
+    <p>Requires TriplyDB API version 26.8.100 or greater; setting it against an older instance throws an <code>IncompatibleError</code>.</p>
+  </dd>
+
   <dt><code>description</code></dt>
   <dd>The description of the group. This description can make use of Markdown.</dd>
 
@@ -92,6 +107,13 @@ const user = await triply.getUser('john-doe')
 await user.createGroup('my-group', {name: 'My Group'})
 ```
 
+The following snippet creates a group that is only visible to its members:
+
+```ts
+const user = await triply.getUser('john-doe')
+await user.createGroup('my-group', {name: 'My Group', accessLevel: 'private'})
+```
+
 
 ## User.ensureDataset(name: string, metadata?: object)
 
@@ -100,6 +122,28 @@ Ensures the existence of a dataset with the given `name` and with the specified
 Inherited from [`Account.ensureDataset(name: string, metadata?: object)`](../account/index.md#accountensuredatasetname-string-metadata-object).
 
 
+## User.ensureGroup(name: string, metadata?: object)
+
+Ensures the existence of a group with the given `name`. If no such group exists yet, it is created with the specified `metadata` and this user as its owner; if it already exists, it is returned unchanged.
+
+### Access restrictions
+
+This method requires an API token with write access for this user.
+
+### Arguments
+
+The `name` and `metadata` arguments are the same as for [`User.createGroup(name: string, metadata?: object)`](#usercreategroupname-string-metadata-object).
+
+If the group already exists and `metadata` specifies an `accessLevel` that differs from the access level of the existing group, an error is thrown rather than the existing group being returned. This prevents code from continuing under the assumption that it ensured, for example, a private group while the group is in fact public. Either change the access level of the group so that it matches, or omit the `accessLevel` key entirely.
+
+### Examples
+
+```ts
+const user = await triply.getUser('john-doe')
+const group = await user.ensureGroup('my-group', {name: 'My Group'})
+```
+
+
 ## User.getDataset(name: string)
 
 Returns the TriplyDB dataset with the given `name` that is published by this user.

docs/triplydb-technical-changelog/index.md

@@ -7,6 +7,11 @@ path: "/docs/triplydb-technical-changelog"
 
 This changelog covers technical changes related to TriplyDB on-premise deployments. See [here](/triplydb-changelog) for the TriplyDB changelog that is user facing.
 
+## 26.8.100 {#26.8.100}
+
+**Release date:** 2026-08-06
+
+None
 
 ## 26.7.200 {#26.7.200}