Skill grants
Control which Team Members can use or manage skills.
Full access users can use and manage Team skills without explicit skill grants. This includes the Company Owner, direct Team Owners and Team Admins, and Company Admins with Full access to the Team.
Team Members need explicit grants.
Use Command Centre
- Select the Team.
- Open Team > Skills.
- Open a skill.
- Search for a Member.
- Choose the permission.
- Select Add.
You can change or remove a Member's permission from the same skill dialog.
Permission levels
| Permission | Meaning |
|---|---|
skill.use | Run the skill. Command Centre can fetch a local execution copy. |
skill.read | Browse or inspect the shared skill files. Includes use. |
skill.edit | Edit-level access where supported. Includes read and use, but does not make the shared Team copy writable. |
skill.admin | Update or delete the shared Team copy. Includes edit, read, and use. |
skill.use lets the runtime cache an execution copy so the skill can run. It
does not give the Member direct browsing controls. Use skill.read when the
Member must inspect the files.
skill.edit does not make the shared Team copy writable. A Member needs
skill.admin to update shared skill files on the Team OS server.
Local SKILL.local.md overrides are separate from Team grants. Editing a local
override does not update the shared Team copy.
skill.admin does not give a Team Member Full access. Command Centre still
requires Full access to manage other people's skill grants. The direct
team:skill maintenance command can accept skill.admin for that one skill.
Maintenance commands
Grant a skill permission:
npm run team:skill -- grant --team <TEAM_SLUG> --skill <SKILL_SLUG> --user <MEMBER_EMAIL> --permission skill.use --by <AUTHORIZED_ACTOR_EMAIL>List skill grants:
npm run team:skill -- grants --team <TEAM_SLUG>Revoke a skill permission:
npm run team:skill -- revoke --team <TEAM_SLUG> --skill <SKILL_SLUG> --user <MEMBER_EMAIL> --permission skill.use --by <AUTHORIZED_ACTOR_EMAIL>Target users must be active Team Members before they can receive skill grants.
For this direct maintenance command, --by must identify a direct Team Owner
or Team Admin, or a user with skill.admin for that skill. Company-level
authority alone is not resolved by the script. Hosted requests always use the
server-resolved signed-in user.
Next: Owner password reset