The sharing docs describe assigning Agent access roles to individual users or whole teams.
Suppose someone's team has the Editor role, but I directly assign that person Viewer. Can they still run tasks? To make one person read-only, would I need to change the team access as well, or can the individual setting override it?
Buda combines the direct, Team and whole-Space grants that apply to a person and uses the highest role. If the Team grants Editor and you directly grant Viewer, the effective role is still Editor. A direct Viewer grant does not override or deny the Team's higher role. To remove editing ability, change the Team grant or membership, then check whether another Team or whole-Space grant still provides Editor or Owner. Space owners and admins also retain broader control.
There is a second distinction: in the current Session access path, Viewer/“Can use” is not a guaranteed no-run, read-only mode. It mainly limits Agent configuration and sharing changes. Someone who can reach the Agent may still be able to run it and use its connected capabilities. If you only want a colleague to see approved output, share a reviewed document or read-only public Session; if they must not issue tasks, do not rely on a Viewer grant, and check whether the Space's open visibility mode still gives them access.
We will align the conflicting Viewer/Can use documentation and track a true “view results but cannot run the Agent” role separately. Do you want this colleague to ask the Agent questions without changing settings, or strictly to view past work? The Chinese discussion covers the same case.
Sign in to join the discussion. Reading is always open; you only need an account to post.
Sign inThe sharing docs describe assigning Agent access roles to individual users or whole teams.
Suppose someone's team has the Editor role, but I directly assign that person Viewer. Can they still run tasks? To make one person read-only, would I need to change the team access as well, or can the individual setting override it?
Buda combines the direct, Team and whole-Space grants that apply to a person and uses the highest role. If the Team grants Editor and you directly grant Viewer, the effective role is still Editor. A direct Viewer grant does not override or deny the Team's higher role. To remove editing ability, change the Team grant or membership, then check whether another Team or whole-Space grant still provides Editor or Owner. Space owners and admins also retain broader control.
There is a second distinction: in the current Session access path, Viewer/“Can use” is not a guaranteed no-run, read-only mode. It mainly limits Agent configuration and sharing changes. Someone who can reach the Agent may still be able to run it and use its connected capabilities. If you only want a colleague to see approved output, share a reviewed document or read-only public Session; if they must not issue tasks, do not rely on a Viewer grant, and check whether the Space's open visibility mode still gives them access.
We will align the conflicting Viewer/Can use documentation and track a true “view results but cannot run the Agent” role separately. Do you want this colleague to ask the Agent questions without changing settings, or strictly to view past work? The Chinese discussion covers the same case.
Sign in to join the discussion. Reading is always open; you only need an account to post.
Sign in