Who is in control? How permissions work when AI agents act for your team

The rule: an agent acts as the person it is working for

When someone asks an agent for help, the agent works on that person's behalf. It can see what they can see. It can't see more because it is an AI, or because an admin configured it.

This also applies when an agent hands work to specialist agents. Each specialist carries the same identity and permissions as the original person. Delegation is never a way around access control.

What agents can see

Documents, agents, chats, and other resources in Team Two have an owner and a visibility level:

• Private: only the owner, and anyone they explicitly share it with.
• Team: members of the owner's team.
• Workspace: everyone in your company's workspace.

Resources can also be shared with specific people or teams, as viewers or editors. When an agent searches your knowledge base, it only searches documents the person asking is allowed to read.

Agents that are shared with a wider group can be set to answer from their owner's documents instead. That is useful for a policy agent that should give everyone the same answer from the same approved handbook. You choose this per agent, and it is visible in its settings.

Chats are private by default, including from admins

A conversation belongs to the person who started it. Admins can manage agents, users, and settings, but they cannot open someone else's chats unless those chats are shared with them. A person can share a conversation so that a colleague can follow it, with or without the ability to post.

We made this choice deliberately. People ask agents things they wouldn't post in a public channel. If every conversation were readable by admins, people would stop using the tool for anything real.

What agents can do

An agent can only use the tools it has been given. You decide, per agent, which integrations and tools it has. An agent with read-only tools can't change anything in your systems. Tools that use external credentials, like a Jira or Notion connection, get those credentials at the moment they run. The credentials are stored encrypted and never shown to the model.

There are also limits on how much work a single request can trigger: how many tool steps an agent may take, how many specialist agents may run at once, and how long each may run. File tools are restricted to the agent's own workspace.

Who can change what

Team Two has three roles: admin, manager, and member. Admins manage the workspace, users, and settings. Managers and members work with agents and resources according to their permissions. Changes to roles are protected so a workspace can't accidentally lose its last admin.

How you can check

• Audit log: every change made through the platform, such as creating an agent, changing a share, or updating settings, is recorded with who did it and when.
• Live view: while an agent works you can see which agent was chosen, which knowledge it searched, and which tools it called, with their results.
• Usage: token usage is tracked per agent and rolled up per user and team, so admins can see where AI is being used without reading anyone's conversations.

What agents don't do

• They don't see documents the person asking can't see.
• They don't use tools they weren't given.
• Specialist agents don't create more agents of their own.
• Your data isn't used to train AI models.

Security teams usually have follow-up questions about hosting, encryption, and model providers. Those are covered on our Security page and in where your data goes. If your review needs more, talk to us.