PERMISSIONS
Who sees, edits or triggers what.
Roles made of actions, granted object by object, to people and to agents alike.
Four actions on your data
Read, create, update, delete. They are granted object by object, or in one go with a wildcard target. Three presets cover most cases: full access, read-only, no access.
Full access adds a fifth action, manage, which governs the permanent destruction of an already-archived record. It is the only irreversible operation of the set, so it carries its own right.
Two scopes: your data, and the platform
The first covers your business objects. The second covers workspace resources: people, settings, files, documents, views, forms, API keys, connectors, environment variables, the audit log.
A person can hold several roles, and the rights add up. You widen an access by adding a role, without rewriting the one already in place.
An agent is an actor, with its own role
An agent does not borrow the rights of whoever launched it: it carries its own identity and its own role, resolved on every read and every write.
The role shipped by default gives it the four actions on records, read and write on documents and files, read on environment variables, and visibility on its own sessions. Nothing else. You replace it with your own the moment you want it narrower.
A reflex starts from zero
An agent is launched, watched, and acts once. A reflex runs unattended and repeats, so it starts with no access at all, not even read.
Its rights are then derived from what a rehearsal actually did, action by action and object by object. Nothing is inferred from a neighbour, so an update never widens into a delete. A widening is visible, and goes back to a human.
How it works
You open your workspace to an external audit firm, for three months and on closed cases only.
You create a role and attach permissions to it: a scope, a target, a set of actions.
You assign it to a person or to an agent. Several roles add up.
On every read and every write, the platform resolves the actor's effective rights.
A refusal is explicit, never an empty result that would look like missing data.
Every role assignment or revocation goes to the audit log.