---
title: "Visibility and .lootattributes"
url: https://loot.build/docs/concepts/visibility
group: "Concepts"
status: written
summary: "Per-path tiers declared in a file, enforced by the engine."
---

# Visibility and .lootattributes

> Per-path tiers declared in a file, enforced by the engine.

Every path is **internal** (readable by anyone with repo access), **restricted** (a named set of key holders), or **embargoed** (encrypted to all until a reveal time). You declare it in `.lootattributes`, a gitattributes-style file: `.env restricted=alice`, `*.md internal`. Unmatched paths default to **internal** — not to the anonymous internet; publishing is a separate, explicit act. The file is versioned like any other, so the policy travels to every clone. [The trust matrix](https://loot.build/trust) is the canonical answer to who reads each tier.