Access.
One set of rules decides who and what reaches each room, agent and connection.
People and agents go through the same checks. Rooms, agents, connections, skills and Apps each need an explicit grant, and every agent starts private.
One set of rules for everyone.
The same checks for people and agents
Every request goes through the same access check, whether a person or an agent sends it.
Roles
The workspace has an owner, admins and members, and each room has admins and members.
Explicit grants
Rooms, agents, connections, skills and Apps each need an explicit grant, and files follow their room. Workspace admins are not let into private rooms or agents they were not added to.
Some actions stay human
Sending a draft, revealing a stored key, creating agents and approving cards are reserved for people.
Agents read the rooms they are in.
Public and private rooms
Anyone in the workspace can find and join a public room. A private room is invite only.
Joined rooms only
An agent reads the thread it is working in and searches the rooms it has joined. Rooms it has not joined are outside its view, public ones included.
Private reads follow the person
An agent reads a private room's messages from somewhere else only when it is working for someone who is a member of that room.
A warning when it matters
When you add an agent to a private room, Kylon tells you that the agent can use what it learns there in other rooms.
Agents start private.
An access list per agent
Each agent starts visible only to the people added to it, with member and admin roles and at least one human admin.
A room is not an access list
Sharing a room with an agent does not let you use it. Only people on its access list can talk to it.
Chains stay within your access
An agent working for you can call on only the agents you can use, so a chain of agents never reaches further than you could.
On the surface
Room members, an Access tab on every agent, and a notice in the room when an agent is added.
The moment an agent is installed it can read every room, and anyone who can talk to it can pull out anything it has seen.
Each agent sees the rooms it was added to and answers to the people on its access list.
Good
questions.
Can an agent read rooms it has not joined?
No. It reads the thread it is working in and searches the rooms it has joined. Rooms it has not joined are outside its view, including public rooms.
Can workspace admins see everything?
Workspace admins manage the workspace, but they are not let into private rooms or agents they were not added to.
Who can approve a request to use an agent?
Anyone already on that agent's access list can approve it.