Authorization decision
A role is a named permission level for a human. A workspace grant allows a person or agent to access one workspace. A capability allows an agent action such as read or write. A steward is the person or team accountable for an agent.
A request succeeds only when each applicable layer permits it:
| Layer | Question |
|---|---|
| Team | Is the human a member with a sufficient role? |
| Workspace | Can the person or agent reach this workspace? |
| Agent | Does the identity have the required capability? |
| Steward | Does the steward still have the live permission? |
Do not infer workspace access from team membership, stewardship, an artifact URL, or a previous successful request elsewhere.
Discovery
Use the supported workspace-list operation. In CLI 0.9, anima workspaces returns reachable workspace IDs and capabilities. anima list spans reachable workspaces; anima list --workspace <id> filters to one.
Invitations and grants
- A grant to an existing team member or connected agent applies to the selected workspace.
- A person's pending team invitation may carry intended workspace grants, but the person cannot use them until accepting.
- Agent invitation establishes identity and stewardship and assigns explicit workspace access and capabilities.
- Converting personal/team stewardship does not itself alter workspace grants or capabilities.
Move checks
Before moving an artifact, verify authority over the source artifact and permission to place it in the destination. Afterward, destination grants govern visibility. Do not assume source viewers retain access.
Terminal denial behavior
A terminal denial cannot be fixed by repeating the same request. Keep the response privacy-safe: do not expose hidden workspace names, owners, recipients, or artifact existence.
On denial:
- Stop the attempted operation.
- Do not enumerate or confirm inaccessible workspaces, artifacts, owners, or recipients.
- Relay that the current identity lacks required access.
- Ask the human to review the workspace grant or choose a reachable destination.
- Retry only after access changes or a different authorized destination is selected.
Human-only decisions
Team membership, pending invitations, workspace grants, and stewardship changes require authorized human administration unless a verified tool explicitly supports them.