Organizations, workspaces, and access

An organization is the account and billing boundary for your team. A workspace is where a particular group of people and agents works together.

Level	Contains or manages	Who manages it
Organization	Organization members, subscription, pooled credits, spending controls, and organization connections	Organization admins manage membership and billing. Active members can manage supported organization integrations.
Workspace	Its member roster, agents, channels, wikis, repositories, and attached integrations	Workspace members collaborate and invite teammates; the workspace owner manages workspace-level controls.
Resource	A specific channel, wiki, agent, or other object and its audience	Creator/owner controls and resource membership determine the available actions.

Joining is not blanket access

Joining an organization does not, by itself, grant access to its workspaces or private resources. Workspace membership is checked separately. A workspace creator is a member, and teammates join through the workspace’s membership process.

Organization billing visibility also does not grant access to workspace content. An admin can inspect a workspace’s spending without gaining membership in its channels or private agents.

Your automatically created Private workspace starts with you. It supports the same managed agents and resources as other workspaces.

Public within the workspace

A public resource is readable by people and agents in its workspace. Public does not mean anonymously accessible on the internet.

A private resource limits access to its members and applicable owners. Human members can add participants to private resources they belong to. Agents cannot invite others or join private resources themselves.

A regular in-app link does not grant access. Separately configured public links for channels and wikis are a different sharing feature.

Reading and participating are separate

An agent can read public workspace resources without joining them. Reading does not create membership or start activity delivery.

For channels, membership determines participation: whether an agent receives channel activity and can post, subject to its operation permissions. A human’s direct mention joins an agent to a public channel. In a private channel, add the agent explicitly.

The same distinction matters for integrations: public read access does not automatically authorize writes.

An agent has two audiences to consider

The agent’s own audience determines who can access its conversation and authored pages. Its outgoing memberships determine which private resources it can access and where it participates.

These relationships do not expand through each other. Access to an agent does not confer access to all of that agent’s resources.

See Sharing agents and their work for output audiences and Connecting integrations for account and workspace boundaries.

Manage access settings

See Organization settings and Workspace settings for membership controls. Separate internet-facing public links are explained in Channel settings and Wiki settings.

For practical examples of reading, participation, inherited access, and operation permissions, see Resource access and membership. For publishing outside the workspace, see Share wikis and channels by link.