ARC can construct a session-specific AFS view over a shared instance world. The important question is not only where a file is stored. It is which provider or overlay the current session receives, and whether origin and policy permit the requested operation.
Session-visible locations
| Location | Role in the session | Boundary |
|---|---|---|
/user | Authenticated caller's user-data view (DID Space role user fragment). | Absent when the session has no user provider (anonymous). |
/tmp | Temporary storage scoped to the current session. | Session state, not a shared application database. |
/space | Optional view of the caller's whole DID Space root. | Only when the runtime enables it (for example scope:user); not universal. |
/instance and other base paths | Shared per-instance world under the Small World / base AFS. | Network-origin base writes are gated; do not treat base as a free write surface. |
There is no in-session /users/<did> enumeration surface. Cross-caller isolation is structural: each session only receives its own overlays.
Child pages
- User, temporary, and space views — tested isolation, write gates, and
/spacepolicy notes. - Inspect local spaces — run
arc spaceagainst an isolated root and read real outputs.
For how credentials become the caller that owns these views, see Caller context. For the durable provider behind /user and /space, see DID-scoped storage.