> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cortex-labs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage workspace access and clearance

> Grant or revoke effective membership and resolve security-level blockers through the correct authority.

Workspace Owners manage member grants. Security Officers assign clearances and lower security levels. These responsibilities can belong to different people.

## Inspect effective access

Open the workspace's access controls. Review direct people and assigned teams. Check each person's effective Owner, Contributor or Reader group.

Membership through several routes matters. Removing a direct grant does not remove an equivalent team grant.

## Grant or change membership

1. Identify the person or exact team and the work they must perform.
2. Check the workspace security level against every affected person's clearance.
3. Select the smallest suitable access group.
4. Save the grant and inspect effective access.
5. Verify a representative operation without widening unrelated resources.

A contributing member still needs dataset Contributor access for ingestion. Collection reach supplies dataset Reader access.

Workspace agent chats remain private unless their owner shares them. A shared chat's audience must be permitted workspace readers. Workspace membership does not automatically expose every private chat.

## Revoke access completely

Remove the intended direct or team route. Check remaining team and direct grants before treating the revocation as complete.

Reopen the effective access view. Revocation affects the next protected operation, including resumed execution and review actions. It does not erase earlier records or recall exports.

A person or team removed from the workspace loses its workspace-agent-chat memberships and shares. Check automated work whose principal depended on the removed grant.

## Change the workspace security level

Inspect the conformance report before the change. It identifies people below the proposed level and datasets above it.

Resolve the intended scope through the responsible owner or officer. Do not lower data protection merely to clear a blocker.

| Change | Authority and constraint |
| - | - |
| Raise workspace level | An authorised manager with sufficient clearance; every affected person must clear it. |
| Lower workspace level | Security Officer, with resource authority and sufficient clearance. Workspace chats follow the new level. |
| Raise dataset level | Dataset editor with sufficient clearance; no reaching workspace can remain below it. |
| Set a person's clearance | Security Officer, within their own clearance. Existing workspace memberships can block lowering. |

Changing a membership or clearance does not relabel data. An Owner grant does not bypass clearance or retention.

Record the intended audience, saved grants, level and resolved blockers. Use [Manage workspace members and security level](/vantage/set-up-a-workspace/members-and-security) for the workspace reader's route.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.