Skip to main content
Workspace Owners manage member grants. Security Officers assign clearances and lower security levels. These responsibilities can belong to different people.

​
Inspect effective access

Open the workspace’s access controls. Review direct people and assigned teams. Check each person’s effective Owner, Contributor or Reader group. Membership through several routes matters. Removing a direct grant does not remove an equivalent team grant.

​
Grant or change membership

  1. Identify the person or exact team and the work they must perform.
  2. Check the workspace security level against every affected person’s clearance.
  3. Select the smallest suitable access group.
  4. Save the grant and inspect effective access.
  5. Verify a representative operation without widening unrelated resources.
A contributing member still needs dataset Contributor access for ingestion. Collection reach supplies dataset Reader access. Workspace agent chats remain private unless their owner shares them. A shared chat’s audience must be permitted workspace readers. Workspace membership does not automatically expose every private chat.

​
Revoke access completely

Remove the intended direct or team route. Check remaining team and direct grants before treating the revocation as complete. Reopen the effective access view. Revocation affects the next protected operation, including resumed execution and review actions. It does not erase earlier records or recall exports. A person or team removed from the workspace loses its workspace-agent-chat memberships and shares. Check automated work whose principal depended on the removed grant.

​
Change the workspace security level

Inspect the conformance report before the change. It identifies people below the proposed level and datasets above it. Resolve the intended scope through the responsible owner or officer. Do not lower data protection merely to clear a blocker. Changing a membership or clearance does not relabel data. An Owner grant does not bypass clearance or retention. Record the intended audience, saved grants, level and resolved blockers. Use Manage workspace members and security level for the workspace reader’s route.