🔑 Privileges
Managing who can do what inside your workspace starts in the Privileges panel.
Where to edit privileges
- Open Settings
- Go to Workspace → Privileges
- Select target role (Admin or Member)
- Toggle capabilities on/off (changes apply immediately)
Privilege categories
| Category | Controls |
|---|---|
| Agent Management | Create/view/update/delete agents and subagents |
| Drive | View/edit/delete Drive folders and content |
| Billing | Plan, invoices, payment settings |
| Member Management | Invite/remove members and update roles |
| Skills Management | View/edit/delete Skills (when enabled) |
What each privilege does
| Privilege (UI label) | What it allows |
|---|---|
| Create new agents | Create new agents in workspace |
| View shared workspace agents | View workspace-shared agents |
| View private agents | View non-shared/private agents |
| Update private agents | Edit private agent/subagent config |
| Delete private agents | Permanently delete private agents |
| View private Drive | Open private Drive folders/files |
| Update private Drive | Upload/edit/re-index private Drive content |
| Delete private Drive | Remove private Drive files/folders |
| Configure billing | Manage subscription and payment configuration |
| Invite members | Add users to workspace |
| Remove members | Remove users from workspace |
| Update member roles | Change Admin/Member role assignment |
| View Skills | Access Skills pages and listings |
| Edit Skills | Upload/edit/rename/attach/detach Skills |
| Delete Skills | Delete Skills and remove attachments |
note
Privilege labels can vary by deployment/feature flags. Use your UI labels as source of truth.
Default role behavior (typical)
| Capability | Admin | Member |
|---|---|---|
| Create new agents | ✅ | ✅ |
| View shared workspace agents | ✅ | ✅ |
| View private agents & Drive | ✅ | ❌ |
| Update/delete private agents & Drive | ✅ | ❌ |
| Configure billing | ✅ | ❌ |
| Invite/remove members | ✅ | ❌ |
| Skills management | Configurable | Configurable |
The Owner can modify both Admin and Member privilege sets.
Practical role design patterns
Pattern A — Builder team model
- Admin: full agent/drive/skills edit
- Member: interact + limited edit
- Billing locked to owner/admin only
Pattern B — Read-mostly operations model
- Admin: deploy and incident response
- Member: view Threads/Artifacts/Feedback only
- Drive write and skill edit restricted
Pattern C — Regulated workspace model
- Minimal member rights
- Strict private Drive access limits
- Skills edit/delete restricted to approved maintainers
Access governance checklist
- Assign least privilege by default
- Separate build vs billing responsibilities
- Restrict delete rights to small admin group
- Review privileges after org/team changes
- Re-validate after enabling new features (e.g., Skills)
Common mistakes
- Granting broad edit rights to all members
- Leaving delete privileges too widely assigned
- Forgetting to review privileges after role changes
- Enabling feature areas without matching privilege policy
Recommended review cadence
- Monthly: privilege drift review
- Quarterly: role model audit by team function
- After incidents: verify over-privileged access was not a factor