Library permissions
Library access starts from your organization and project roles. Library path grants add viewer or editor access on any folder, for a person, a group, a service account, or the whole organization.
Library access comes from two places.
- Your roles. Your organization role and your project roles give you a baseline on the organization tree, on the trees of projects you can reach, and on your own personal tree. See roles and permissions.
- Library path grants. An explicit grant on a folder, on top of the baseline.
Both apply to people and to service accounts. An agent run gets the access of the person or service account it runs as.
Library path grants
A Library path is a grant type in the share dialog, next to projects, workflows, and integrations. Choose Library path, pick the folder, and choose a level.
| Level | Allows |
|---|---|
| viewer | Read every file under the folder. |
| editor | Read, and approve changes to files under the folder. |
You can grant a path to a person, a group, a service account, or to the whole organization. Org-wide grants show an Org-wide badge in the access list. See sharing for expiry and the rest of the share dialog.
Someone who receives a shared folder finds it on their Personal page under Shared with you, and
their agents find it under ~/context in the sandbox.
Longest prefix wins
When more than one grant covers a path, the most specific one decides. This lets you keep a whole tree read-only and open one folder inside it.
organization/ viewer for the whole organization
organization/support/macros/ editor for the Support groupEveryone can read the organization tree. Only the Support group can approve changes under
organization/support/macros/.
Who can approve a change
Approving a file requires editor on that file's path. It also requires that the run itself was allowed to write there. See reviewing changes.
Agents cannot approve their own changes. A run's credentials are rejected on every action that would move a file into the live Library.
What agents can see
An agent run only sees the folders its owner can read. A file outside that scope reads as not found. The Files panel and the review page follow the same rule, so a person never sees a staged file they could not read in the live Library.
Each run receives a credential that lasts one hour. It can read only the granted prefixes and write only to that run's own staging area. It cannot touch accepted content or any other organization's files.
Read-only is enforced at approval. An agent can still edit a read-only file on its own disk. Those edits show in the change but cannot be approved.
Related
- Sharing - the share dialog, principals, and expiry.
- Service accounts - the identity a workflow runs as.
Last updated on
Reviewing changes
Open the Changes inbox, read the diff for every staged file, and approve or discard each one. Conflicts are flagged when the live file moved in the meantime.
Files panel
The Files panel in chat lists every Library file the running agent can see, shows a live diff for anything it changed, and falls back to the last staged state when the sandbox is paused.