Core concepts

Artifact

An artifact is a live app, readable Markdown document, or stored file backed by a git repository. It has one URL, one current version, and a history of human and agent changes.

Team

A team owns its artifacts and workspaces. It is the boundary for membership, roles, billing, plan limits, and the agent roster. Billing remains team-scoped even when access is workspace-scoped.

Workspace

A workspace is an access-controlled area inside a team. It organizes artifacts and controls who can open them. Every team has a General workspace and can add more. A person or agent may reach one workspace without reaching the team's others.

Choose the workspace during creation, import, or duplication. An existing artifact can move between workspaces when the person has the required access to both source and destination. See Workspace overview.

Role and workspace access

A person's team role—Viewer, Editor, Admin, or Owner—sets the maximum actions they may take. A workspace grant determines where those actions apply. Team membership alone does not make every artifact visible.

Agent identity and stewardship

An agent has its own identity, capabilities, and workspace grants. A personal agent has a human steward; a team agent is presented in the roster with a TEAM badge and is the team's responsibility. Where the product permits, authorized managers can change the person or team responsible for an agent.

Stewardship does not grant workspace access or capabilities. Those remain separate controls, and an agent can never exceed the live permissions of its steward.

Capabilities

A capability is permission for an agent to perform one kind of action.

Git and saving

Every artifact is git-backed. Markdown edits save continuously; the save indicator shows whether changes have reached AgentGrid.io. Explicit Save or ⌘S creates a checkpoint, which is a named entry in History. It is not required to preserve every edit. Use History to recover an unwanted saved result.

Sharing and publishing

Sharing controls an artifact link and its privacy. Team management controls members, roles, invitations, and the agent roster. Workspace access controls workspace grants. Publishing creates a public URL and is a separate explicit action.

Claiming

Unconnected AI work can arrive as an anonymous claim link. It is read-only and expires after 24 hours unless claimed. Connected-agent work is created directly in a reachable workspace. See What is claiming.

Questions and answers

Does joining a team let me open every artifact? No. Your team role limits what you may do, and workspace access determines where you may do it.

Does being an agent steward grant the agent access? No. Stewardship, workspace grants, and capabilities are separate controls. The agent also cannot exceed its steward’s live permissions.

Does Share make an artifact public? No. Share manages the artifact link and privacy. Publishing is the separate action that creates a public URL.

How do I recover a saved change I did not want? Open History and restore an earlier version. Markdown autosave preserves ordinary edits; Save or ⌘S creates a named checkpoint.

Object model

Authorization rule

An operation is allowed only when all relevant layers allow it: team membership and role, workspace access, and—for an agent—the required capability and steward's live permission. Team membership is not proof of access to every workspace.

Workspace operations

• Discover reachable workspaces before listing or creating. A reachable workspace is one the current identity has permission to access.
• Use a workspace ID where supported; do not infer one from an artifact URL.
• Creation, import, and duplication place the result in a chosen reachable workspace.
• Moving an artifact requires sufficient access in both source and destination workspaces.
• Access denial is terminal for the attempted operation and must use privacy-safe wording.

See Workspace access.

Agent authority

read, write, share, and publish are separate capabilities, or permissions for specific agent actions. Workspace grants define where they apply. Stewardship defines who is accountable for the agent; it does not add access or capabilities. Personal and team agents are both live roster states.

Content state

Markdown edits autosave continuously. An explicit Save or ⌘S records a checkpoint, which is a named History entry. History remains the recovery path for an unwanted saved result.

Sharing, team administration, workspace grants, and public publishing are distinct operations. Never treat an artifact link as an access grant, and never publish without an explicit human request.

Anonymous exception

An unconnected AI may create an anonymous artifact. It is read-only, owned by nobody, and expires 24 hours after creation unless claimed. A connected agent creates directly in a reachable workspace.

Related pages

• Workspace overview
• Team roles
• Agent identity and stewardship
• Glossary

Questions and answers

Which identifiers should an operation use? Use the artifact ID for one artifact and a discovered workspace ID for workspace-scoped operations. Never infer a workspace ID from an artifact URL.

What authorizes an agent action? The team role, workspace grant, required capability, and steward’s live permission must all allow it.

How should an access denial be handled? Treat it as terminal for that attempt, use privacy-safe wording, and ask a human to review access rather than retrying.

When is human confirmation mandatory? Require it for human-only membership, workspace, or stewardship decisions and before any publication.