Skip to main content
Workspace access controls who can read and change the records in a shared workspace. Use Access to add people, grant a group a role, and review the agents and API keys that can reach its content.

Before you begin

You need workspace administration permission. Organization administration alone does not replace the workspace’s access checks. Personal workspaces have no shared access controls. Adding an existing teammate requires access to the organization directory. Inviting a new email address also requires organization invitation permission.
1

Open access list

Open Settings, select the workspace under Workspaces, then select Access.One table lists one kind at a time through its Members, Groups (when offered), Agents, and API keys sub-tabs. Each row shows the name, the Added date, and the role; a row’s second line adds detail, such as a person’s email address or an API key’s last use. Members lists people who have access first, then pending invitations marked Invited. Search within the selected sub-tab and filter it by role; in Members, the filter’s Invited option lists only the invited. Use the pager after ten rows.
2

Give access

  1. Select Add people (on the other sub-tabs: Add group, Add agent, or Add API key). The workspace’s row menu in the Settings → Workspaces directory also offers Give access when you can manage its members, which opens the workspace’s settings on Access with this dialog already up.
  2. Choose People, Groups (when offered), Agents, or API keys in the dialog; your picks are kept while you switch tabs.
  3. Select the people or identities to add. For people, search by name or email. If you can invite and the address is new, select its invitation option.
  4. To add many people at once, paste a list of email addresses into the people field — a column copied from a spreadsheet or names and addresses copied from a chat or mail client both work — or select Import CSV and choose a .csv, .tsv, or text file. The list resolves against the organization directory and lands as selections. A notice under the field reports how many were added and names anyone it left out and why: the address is not an email address, nobody in the organization has it, they are already in the workspace or already selected, or they are past the 50 people a field holds at once. Select Copy skipped on the notice to copy the left-out addresses.
  5. Select Give access.
The Role control at the foot of the dialog sets the role for everyone in the batch: Builder unless you choose Admin or Viewer. A read-only API key receives Viewer access whatever role you choose. Change a grant’s role afterward when needed.People already in the workspace are not offered, and groups, agents, or API keys that already have access appear selected. Revoked API keys are left out; create a new key under API keys (see Manage API keys).New email addresses receive an invitation first. If only part of the batch succeeds, the dialog keeps failed selections so a retry addresses those entries.
3

Resend or revoke invitation

In Members, an invited row’s action menu offers Resend invite and Revoke invite when you have organization invitation permission (see Before you begin); without it, the row lists the address and role with no actions. Revoke invite asks for confirmation. After you confirm, that address can no longer use the invite to join the workspace, and you can invite it again later. You can also resend and revoke from Pending invitations in the organization’s member settings; see Invite members.
4

Change role

Select a row’s current role and choose Admin, Builder, or Viewer, where the identity allows it. Admin is the workspace administrator role, so choosing it asks for confirmation first. Your own role is read-only. Some machine identities also have a scope that limits the roles available.A group’s role applies to its members. See Manage groups for changes to group membership.
5

Remove access

Open the row’s action menu and select Remove from workspace, then confirm. For a group, review Remove group access? and select Remove access.This removes that workspace grant, not the person’s organization account. Removing a group’s grant leaves its members’ direct grants and access through other groups in place. Review group grants as well when the person can still reach the workspace through a group. You cannot remove yourself through the row menu; use Leave workspace.
6

Verify change

Search the selected access list again and confirm the role or absence. For an invitation, check its pending state. Ask the person to refresh and verify the access intended for them.
For unavailable controls or a workspace that still cannot be opened, see Workspace access errors.