Description
Access Management is the Settings suite for governing who and what may act in a workspace. It brings together People and Agents, custom and system roles, grants, approvals, and an audit log. Owners can inspect principals, change status, assign permissions and Dotabase grants, build roles, review approval requests, and create an agent through a guided name-to-credential-to-tool-profile flow.
The UI reads the server-resolved permission model rather than recreating authorization rules in the browser. Individual tabs and actions disappear when the actor lacks the necessary permission, and sensitive agent credentials are revealed only at issuance. In-tab master-detail flows keep role or agent creation within the Access context while a settings-top-bar breadcrumb preserves orientation.
Selling Points
- Gives owners a single operational view of human and agent access instead of splitting identity across unrelated screens.
- Makes grants and role membership inspectable before a permission problem reaches a production workflow.
- Treats agents as first-class principals with scoped credentials and tool profiles, supporting safe automation without shared user tokens.
- Preserves an audit trail and approval queue alongside the controls that create security-sensitive changes.
- Hides unauthorized actions rather than presenting controls that will inevitably fail.
User Story
A workspace owner creates an agent, chooses the minimum required grants, receives its one-time credential, and assigns a tool profile. They later inspect the agent alongside people, review an approval request, and use the audit log to confirm who changed a role. A regular member sees only the surfaces their resolved permissions allow.
Extension Surface
The suite is configurable through roles, principal state, grants, and approval decisions. apps/web/src/modules/access/management/RoleBuilderPanel.tsx exposes role composition, while apps/web/src/modules/access/management/GrantBlock.tsx edits the supported permission and Dotabase-grant sets. The browser does not offer an external authorization-provider seam, so configurable is the correct rating.
Capabilities & Limits
- Lists and manages people, agents, roles, approvals, and audit events.
- Creates agents with scoped grants, a one-time credential, and a generated tool profile.
- Uses server-resolved effective permissions for every visibility decision.
- Limit: the UI cannot invent permissions or override tenant boundaries; unavailable actions remain absent, and issued secrets cannot be recovered later.
Implementation Map
apps/web/src/modules/access/management/AccessTab.tsxapps/web/src/modules/access/management/PeopleAgentsSurface.tsxapps/web/src/modules/access/management/RolesSurface.tsxapps/web/src/modules/access/management/AgentCreateFlow.tsxapps/web/src/modules/access/management/AuditLogSurface.tsx