Skip to main content
Workspace roles determine what an identity can do with the records in that workspace. The app uses the permissions returned by the service when offering each action. The creator receives the workspace’s first administrator grant. Organization administration and workspace access are separate; opening organization settings does not replace permission on a workspace.

Save, release, and approve

A record created by a script or service has no owner, so only a workspace admin can release it.

Direct and group access

Settings → Workspaces → Access separates Members, Groups where supported, Agents, and API keys. A group grant gives its members the group’s workspace role. Removing one direct grant can leave access supplied by a group. A machine identity’s own scope can cap its role. A read-only API key stays Viewer even when the usual default for a new grant is Builder. Workspace administrators change another row’s role from its role menu. Your own role is read-only. See Manage workspace members.

Visibility and joining

The open option uses your organization’s name in the app. It does not publish records to the internet. A child workspace cannot be more open than its parent. When offered, Join workspace adds the caller as a Builder. The Workspaces page in Brain — open it from the home’s Workspaces card — shows Join on the row of each workspace you can join, and confirming joins you and opens that workspace; in Settings → Workspaces, the Open to join filter lists them, and Join in a row’s Your role column joins you. If Join is absent or the service refuses joining, ask a workspace administrator to give access. There is no request-access workflow for a workspace that does not offer joining. Opening a shared artifact’s link works the same way for every kind: when the link names a workspace you have not joined, the artifact’s page offers Join workspace instead of an error message.

Leave workspace

  1. Open Settings and choose the workspace under Workspaces.
  2. Select General → Danger zone → Leave workspace.
  3. Confirm Leave.
The workspace’s row menu in Brain also offers Leave workspace when permitted, on the workspaces list and on the Workspaces page. The workspace’s own home in Brain offers it too, in its More actions (⋯) menu: select Leave workspace, read Leave workspace?, then select Leave, and you land on your organization’s home. After leaving, verify any other grants that could still provide access. An administrator can add you again, and you can rejoin when Join workspace is offered.
The last workspace administrator cannot leave, be removed, or be demoted. Give another member administrator access first.

Protected workspaces

Personal workspaces have no shared roster and cannot be joined or left. Their owner is their administrator: for example, a project in a personal workspace can be given its agent (Claw) by the owner alone. The roster is still frozen, so there is no member administration and no one to give access to. Personal and organization root workspaces cannot be renamed, reparented, or archived. The organization root cannot be left either. Their settings show no Profile section: the General tab shows the workspace ID under Details instead.