Team roles

A person's role is their named permission level in the team. It sets the maximum actions that person may take. A role does not by itself grant access to every workspace.

The four roles

Manage invitations, active members, role changes, and ownership through Team management. Use Workspace access to decide which workspaces each person can reach.

Role and workspace grant answer different questions

A role answers what may this person do? A workspace grant gives a person or agent access to one named workspace. It answers where may they do it? Team membership alone does not expose every workspace, and people with the same role can have different workspace access.

When an artifact moves, the destination workspace's access list applies. Someone who could see it in the source workspace may lose access, while a person granted to the destination may gain it.

Roles and agents

Agents do not hold human team roles and do not consume seats. An agent instead has:

• personal or team stewardship;
• explicit workspace grants; and
• read, write, share, or publish capabilities, which allow those types of actions.

A personal agent is accountable to one human steward. A steward is the person or team accountable for an agent. A team agent is accountable to the team and appears with a TEAM badge. The badge marks team accountability. Stewardship never grants workspace access or capabilities by itself.

Where permitted, authorized managers can change the person or team responsible for an agent. If the original steward leaves, review the agent in current agent administration and assign it to someone else, convert it to a team agent, or revoke it. See Agent identity and stewardship.

Seats and separation

People use seats; agents do not. Use separate workspace grants when audiences differ. Artifact-link privacy and publishing are separate controls and do not replace team membership or workspace access.

Coming soon

• A reusable invitation link with a default role instead of per-address invitations.
• Team-level policy ceilings limiting what agent capabilities members may grant.

Questions and answers

Does an Admin or Owner automatically see every workspace? No. A role sets the maximum actions the person may take; workspace grants decide where those permissions apply.

Do agents use team seats or human roles? No. Agents use stewardship, workspace grants, and capabilities instead.

What happens to access when an artifact moves? The destination workspace's access list applies. People or agents with source access may lose visibility.

Role and permission ceiling

A role is a named team permission level for a human. Its permission ceiling is the most that person may do.

A role is not proof that the human can reach every workspace. A workspace grant gives access to one named workspace.

Administration routes

Direct humans to Team management for invitations, pending members, role changes, removals, and ownership. Direct them to Workspace access for per-workspace grants. Artifact Share controls a link and privacy; it does not administer roles, workspace grants, or the agent roster.

Authorization layers

For a human, both team role and workspace grant must permit the action. For an agent, evaluate:

1. active identity and personal or team stewardship;
2. explicit target-workspace grant;
3. required capability; and
4. steward's live authority.

Team membership, stewardship, and a previously reachable artifact do not imply access to another workspace.

Agent distinctions

Agents do not hold human roles or consume seats. A personal agent is accountable to one human steward. A team agent is accountable to the team and displays a TEAM badge. The badge marks team accountability. A steward is the accountable person or team. Authorized managers may convert or re-home stewardship where permitted. Re-home means assign accountability to another steward.

If an original steward leaves, instruct an authorized manager to use current agent administration to re-home, convert, or revoke the agent. Stewardship changes do not automatically change workspace grants or capabilities.

Artifact moves

After an artifact moves, destination-workspace grants govern visibility. Verify both source and destination authority; do not assume source viewers retain access.

Planned features

Reusable default-role invitation links and team-level agent policy ceilings are coming soon. Current workspace grants and personal/team stewardship are already live.

Questions and answers

Does a human role identify every reachable workspace? No. The role sets a permission ceiling; each workspace still requires its own grant.

Do agents receive Viewer, Editor, Admin, or Owner roles? No. Check agent identity, stewardship, workspace grant, capability, and steward authority instead.

What should be verified after an artifact moves? Verify destination-workspace access for each required person or agent; source-workspace access does not carry over automatically.