Least Privilege
Capability is granted by the workspace,
not decided by the model.
Access is governed at organization, workspace, and group level, with default-deny tool gating on top. Even when a model requests a tool, the platform blocks it unless that workspace was explicitly permitted.
Structure
Three layers of access governance
Each layer answers a different question. Together they separate the scope someone operates in from the level of control they hold within it.
Organization Roles
owner · admin · memberMembership and administration of a single company — who can write budgets, change settings, manage access, and run exports.
Workspace Members
owner · admin · member · viewerPer-project membership shown in the access matrix — who can see and act inside a given workspace.
Group Roles
group_admin · group_auditorCross-company scope. The auditor reads every company without control; the admin controls across all of them. Scope and level are deliberately separate concerns.
Agent Skill Management
Default-deny tool access
The question is not what the model is willing to do. It is what the workspace has been granted.
Each workspace type carries an allow and deny list, defaulting to deny. When a model requests a tool that the workspace does not hold, the platform refuses — the request never reaches execution. This is enforcement at the platform layer rather than an instruction the model is asked to respect.
The practical shape follows the domain. Advisory workspaces deny command execution and file mutation outright. Development workspaces permit build and run tooling while still denying destructive operations. The allowlist is configuration, versioned with the rest of governance policy.
Entitlements
Which workspace types a company can use at all
Separate from who may act inside a workspace is the question of whether a company has access to that workspace type in the first place.
Per-company grants
Paid workspace types are gated per user and per company. Group admins grant workspace types to individual companies from the Group tab.
Deny by default on failure
If an entitlement check cannot complete, the default is denial. An error does not become an accidental grant.
Free types always available
Workspace types designated free remain available without an explicit grant, so baseline capability is never blocked by an entitlement lookup.
Visible in the console
Entitlements are managed and reviewed from the Group tab alongside cross-company usage rollup.
Isolation
Enforced below the application layer
Access control that lives only in application code fails the moment a query is written that forgets to apply it.
Multi-tenancy is enforced at the database layer through row-level security policies scoped by organization and project membership. The database refuses cross-tenant reads regardless of what the application asks for.
Users see only their own ledger rows through this mechanism; aggregation across an organization happens server-side under an explicit role check rather than by widening what any individual can read.
Least privilege the model cannot argue with
See how organization, workspace, and group roles combine with default-deny tool gating and database-level isolation.