Roles, ownership, and permissions
Understand who can view, change, share, and administer each kind of resource.
Access depends on your organisation, role, resource ownership, and the surface through which you act. Being signed in is not a universal permission to every item.
Access levels
| Context | Typical purpose |
|---|---|
| Member | Read workspace resources and perform permitted everyday changes |
| Administrator | Manage organisation-wide settings and administrative operations |
| Read-only viewer | Inspect permitted resources without ordinary management writes |
| App owner | Manage the app and its owner-scoped configuration and resources |
| Shared app visitor | Use the explicitly shared app interface within its sharing policy |
| Public app visitor | Use an app deliberately made public, without general workspace access |
Some manual connection and workflow operations are available to authorised members, including destructive controls where permitted. The Assistant can impose an additional administrator requirement for destructive tools. A button available manually does not guarantee that the same action can be delegated to the Assistant.
Ownership boundaries
Shared app access is distinct from management access. App parameters and owner-scoped review records do not become generally visible merely because the shell is shared. A person must have the required owner and human-review authority for a decision.
An app that reads another app's published outputs needs the corresponding access. A connection's scope and provider account constrain the resources it can reach. Neither an app binding nor an Assistant prompt grants more permission.
Organisation administration
Organisation-wide AI budgets, Trash retention, optional extensions, MCP provider changes, and tool reapproval require administrative authority. A system-managed provider can be visible without being editable by a tenant administrator.
If an action is missing or refused
Check your account and organisation, then the item's owner, sharing settings, and current lifecycle. Ask an administrator or owner for the specific access needed. Do not duplicate or publish an item simply to get around a denied action. See access troubleshooting.