Roles and permissions

Team OS checks Company access, Team roles, and resource grants on the hosted server. The local workspace cannot give itself more access.

Company roles

Company roles control work across the Team OS installation.

Role	What it means
Company Owner	Controls Company Admins and access across all Teams. Has Full access to every active Team.
Company Admin	Can view the Company Team list, create a Team, and request Full access to other Teams. Does not receive Full access to every Team automatically.

Only the Company Owner can approve Company access requests, manage Company Admins, transfer Company ownership, or permanently delete a Team.

Team roles

Team roles apply to one Team.

Role	What it means
Team Owner	Highest direct Team role. Has Full access to that Team.
Team Admin	Manages normal Team administration. Has Full access to that Team.
Team Member	Can use shared Team context and memory, plus the clients and skills granted to that member.

Only active Team memberships count. An invited or suspended membership does not give a direct Team role. Company access is resolved separately.

Full access

A user has Full access to a Team through any of these sources:

Source	Effective Team authority
Company Owner	Full access to every active Team.
Direct Team Owner role	Full access to that Team.
Direct Team Admin role	Full access to that Team.
Company Admin with an active Company access grant	Full access to that Team.

Full access includes:

implicit write access to every active client in the Team;
administrative access to every shared Team skill;
Team administration and shared memory management.

Full access does not need a separate client or skill grant. Command Centre may show this access as implicit and protected.

A Company Admin without a Company grant or direct Team role does not have Full access to that Team.

Member client grants

Client grants limit a Team Member to specific clients.

Grant	What it allows
`read`	Read allowed client files and search that client's memory.
`write`	Includes read, and allows permitted client file and memory writes.

A Team Member can belong to a Team and still see no clients. A Full access user sees every active client without these grants.

Member skill grants

Skill permissions are ordered from narrow to broad.

skill.use < skill.read < skill.edit < skill.admin

Permission	What it allows
`skill.use`	Run the shared skill. The runtime can fetch a local execution copy.
`skill.read`	Browse or inspect the shared skill files. Includes use.
`skill.edit`	Edit-level access where supported. Includes use and read, but does not make the shared Team copy writable.
`skill.admin`	Update or delete shared Team skill files. Includes the lower permissions.

Changing who receives skill permissions is a Team administration action. Any Full access user can manage those grants, including a Company Owner, a granted Company Admin, a Team Owner, or a Team Admin.

Local skill copies and private SKILL.local.md files are separate from the shared Team copy. A local edit does not update the Team skill on the server.

Common actions

Action	Required authority
Request Full access to a Team	Active Company Admin without Full access to that Team.
Approve or deny a Team access request	Company Owner.
Invite a new Team Member or Team Admin	Full access to that Team.
Create a client	Full access to that Team.
Grant or revoke member client access	Full access to that Team.
Use a client workspace	Full access, or a matching active member grant.
Push client files	Full access, or an active member `write` grant.
Use a shared Team skill	Full access, or a matching active member skill grant.
Manage shared Team memory	Full access to that Team.
Transfer Company ownership	Company Owner.

Team access and task permission modes

These controls solve different problems:

Team OS roles and grants decide which hosted Teams and resources a user can reach.
A task permission mode decides how the agent asks for approval before local commands and file changes.

Full access to a Team does not bypass a task's local permission mode. See Task permission modes.

Trust boundary

The hosted server resolves the real user from a signed session or server-issued token. It then checks active Company access, Team access, client access, and skill access.

A request can ask to use a Team or client, but IDs in the request do not become trusted identity. The server rejects IDs that the resolved user cannot access.

Next: Connect a workspace to Team OS

On this page