Most resources start out visible to you alone. To share one, grant a group access to it.
Channels and flows are the exception. Both are created readable by everyone by default. To narrow one, open it after creating and switch its access permission to Selected groups only.
Access Control modal — search for groups, add them, and grant edit rights; opened via the Access button
If the group permission your admin granted is Read, you can view and use the resource but cannot edit it. A greyed-out save button, or a missing Access button, is almost always this.
Element
Read
Write
Save & Update / Save & Create button
Disabled
Normal
Add / delete item buttons
Disabled
Normal
Access button
Hidden
Shown
If you need to edit, ask your admin to raise your group’s permission for that feature to Write.
The […] menu in the workspace list appears only when you are both the owner and hold Write group permission for that feature. Miss either one and the menu stays hidden even on resources you created. Admins always see it.
Read-only access still lets you view and use the resource. You can chat with a read-only agent, but you cannot change its prompt or model.
A Permission area on the screen itself (Private / Public)
Use it as is. Choosing Private reveals a Groups card below
Scheduled tasks
A lock button under Visibility (Public / Private)
Click it to open the same Access Control modal
The same concept goes by different names per screen. The Access Control modal says Access permission · Everyone · Selected groups only, while create screens and scheduled tasks say Permission · Visibility · Public · Private. They mean the same thing — Public = Everyone, Private = Selected groups only.
Inline permission area on a create screen — pick Read or Write per group
This is the flow for edit screens and scheduled tasks.
1
Set Access permission to 'Selected groups only'
Leave the Access permission selector on Selected groups only. Switching it to Everyone removes the group list entirely — the resource is already open to everyone, so there is nothing to narrow.
2
Search for groups and add them
Type into Search group name under Accessible groups to open the list. Tick several at once, then press Add selected groups.Groups already in the table carry an Added badge and cannot be picked again.
3
Grant edit rights
Being listed in the table is read access — there is no separate read checkbox.To allow editing too, tick Editable on that row. To remove a group, press Delete.
4
Apply
Click Apply at the bottom of the modal. Nothing reaches the resource until you do. Close the modal without it and your edits are dropped.
5
Save
Click Save & Update or Update on the page.Tools and Marketplace detail screens are the exception — there, pressing Apply saves right away, so no separate save is needed.
Always press Apply in the Access Control modal.Picking groups and then closing the modal leaves the change unapplied — and that failure looks exactly like a successful save. A share that didn’t go through gets reported to you (“I can’t see it”), but a resource you meant to narrow from public to a single group, and didn’t, gives off no signal at all.Closing with unapplied edits raises a confirmation:
Access control changes have not been applied
Closing now discards them. Press Apply to keep the changes.
Choose Keep editing to go back and press Apply. Discard changes throws the edits away.
Setting Permission to Private reveals the Groups card below.
2
Add groups and pick a role
Pick groups one at a time from the Add groups selector. A group disappears from the selector once added, so whatever remains is what you have not added yet.Choose Read or Write on each row. Write automatically carries Read with it.
3
Save
Click Save & Create. There is no modal here, so no Apply step.
Agents, flows, and prompts have no inline area even at create time. They use the Access button at the top of the screen to open the Access Control modal instead. Tags have no access control at all and are governed purely by group permissions.
Organizational units cannot be set from this screen. To open a resource to an org unit, an admin must link that org unit to a group — members of the org unit are then treated as members of that group. See Groups & Permissions.
Grouping still pays off when you open access broadly. If a whole department needs Read, keep one group with that org unit linked to it, and split the few who need to edit into a separate group with Editable ticked.
Write includes Read. You do not need to add Read separately for the same target.Here is what Read and Write mean for each feature. The order follows the workspace tabs.
Feature
Read
Write
Agents
Select and use in chat
Edit agent settings
Flows
Run the flow
Edit the flow
Knowledge
View, open documents
Add/delete documents, change settings
Databases
Use DB queries
Change DB connection settings
Glossaries
Reference terms
Add/edit terms
Knowledge Graphs
View and search the graph
Edit the graph
Guardrails
View the guardrail
Edit guardrail rules
Prompts
Use the prompt
Edit the prompt
Skills
Attach to an agent and use
Edit the skill instructions
Tools
Use the tool
Change tool settings
Marketplace
Attach to an agent and use
Change service settings
Tags
No access control — governed by group permissions only
To open a resource to the whole organization, set Access permission to Everyone in the Access Control modal. Create screens and scheduled tasks label the same choice Public.Every user can then read the resource; Write still belongs to the owner and admins only. Switching to Everyone also removes the Accessible groups list from the screen.
If Everyone (Public) is not offered at all, your admin has not granted public sharing permission for that feature. Some features are restricted so that only admins can make them public. See Groups & Permissions.
Set channel permissions by opening the channel in the sidebar and choosing Edit Channel. Here access control sits directly on the screen rather than in a modal.
New channels default to readable by everyone. To narrow one, switch it to Selected groups only yourself.
Groups can only be granted Read. Unlike other screens, the Editable column does not render at all here.
Read permission alone lets a user both read and post messages. In a channel, Read means participation.
Creating and deleting channels is restricted to admins.
Channel permissions — groups only, with no Editable column
Projects
Projects have no on-screen access control. Neither the create screen nor the settings screen has a permission area.To hand a project to someone else, press Copy to Users on the settings screen. A Share modal opens where you search for and select the target users, then confirm with Copy to Users. This creates an independent copy for them, so later edits to your original do not reach that copy.
Projects do carry an access-control field internally, so the API can work with it. Only the on-screen controls are missing.
Scheduled tasks
Scheduled tasks support both approaches. You can share one with a group through access control, or hand over a copy.Access control opens from the lock button under Visibility. It is the same Access Control modal used elsewhere, and here you can grant Editable as well.For a scheduled task to appear at all, however, your admin must both enable the feature and grant the group permission. Both conditions must hold.
The user listed directly and org unit branches cannot be created from any screen. They remain in the evaluation logic, so values granted in the past or set through the API keep working — but the only axis you can assign today is groups.
Checking Read also checks Write, so holding Write implies Read.If a user belongs to several groups, the highest permission wins. Read from group A and Write from group B resolves to Write.
Read through wide groups and editing through narrow ones keeps things manageable. Where you need a whole department — the Engineering (all) row above — have an admin keep one group with that org unit linked to it.
Permissions are stored in the resource’s access_control field in this shape. You never need to edit it directly — it is here for API integration and troubleshooting.On screen you only ever edit group_ids. user_ids and org_unit_ids still take part in evaluation but have no on-screen controls.
No. Public opens Read only. Editing and deleting stay with the owner and admins.
How do I share with one specific user?
No screen lets you name an individual user directly. Create a group containing only that user, then add that group under Accessible groups.
What happens when a user belongs to several groups?
The highest permission applies. Read from one group and Editable from another resolves to edit access.
Can I share with an organizational unit?
Not directly from the resource screen. Instead, an admin links an org unit to a group, and members of that org unit are then treated as members of the group. Linking a parent org unit pulls in its child organizations too.So to open something to an org unit, add “the group that org unit is linked to” under Accessible groups.
Do permission changes take effect immediately?
Yes — once saved, they apply with no deploy or restart needed.Note that editing through the Access Control modal takes two steps: press Apply, then Save on the page. Tools and Marketplace detail screens save on Apply alone.
