Permissions & access groups
Control what people and agents can use without giving everyone administrator access.
access permissions roles admin RBAC groups security memberOn this page
Understand the two agent typesReview a person or agentUse access groupsAdministrator accessPermissions are not approvalsDiagnose missing accessUnderstand the two agent types
A personal agent uses its owner’s permission identity. Changing that person’s grants changes the access their personal agent can use.
A shared agent has its own permission grants. Configure both who may use the shared agent and what the agent itself can access. Those are separate decisions.
Interactive shared-agent actions can check both the agent and the person making the request, as well as the target record's rules. Membership lets a person use the agent; it does not automatically authorize every action the agent could perform.
Review a person or agent
Open Settings → Access if you have permission to manage access. Select the relevant person or agent and inspect their effective access. Grants can come from individual permissions and assigned access groups.
Maya is not an administrator. Her Customer success group grants portal access; billing management is not granted.
Use the permission groups to find the relevant platform area or app. Some apps separate reading, collaboration, and management. Giving someone permission to read records does not necessarily let them configure the app.
Use access groups
Access groups collect permissions for a common responsibility. Create a group with a clear name and purpose, add the intended permissions, and assign the appropriate people or agents.
For example, an operations group might grant access to specific task and purchasing workflows while leaving billing administration to administrators. Review membership whenever a person’s responsibility changes.
Group changes affect the principals assigned to the group. Check effective access after removing a grant: another group or direct permission may still provide it.
Administrator access
Administrator status provides broad workspace authority, including settings such as organization management and billing. Use it for people who need to administer the workspace. Prefer focused permissions and groups for ordinary app work.
Permissions are not approvals
Permissions define available authority. Approvals decide whether an authorized agent action should wait for a person to review it. Approving an action cannot bypass a missing permission.
App-level sharing and membership also matter. A mailbox, private chat channel, or shared document can have its own access rules in addition to platform permissions.
Diagnose missing access
Check the selected user or agent, direct grants, group membership, app installation, and any record-specific sharing. Refresh after a change and try a small read operation before repeating the original task.