Access control

Shiplet evaluates viewing and editing separately through the trusted host. View access never grants edit access.

Visibility

Visibility	Who can open it
private	Administrators, owners, and people with an explicit grant.
organization	Members of the active organization.
unlisted	Anyone with the link.
public	Anonymous visitors, including discovery traffic.

People and teams

Organizations contain members and teams. A Shiplet can also grant access to an exact invited email address. Invitations become effective for the matching signed-in identity.

Open Account at /account to inspect or switch the signed-in identity. Open Workspace at /workspace to choose the active organization.

Invite links

Organization administrators create invite links in the Invite links section of Workspace. Each link targets the whole organization or exactly one team. It can allow a set number of uses or unlimited uses, expire after a number of days or never, and be reserved for specific email addresses. Administrators can copy the same link again later and revoke it at any time, and Shiplet records every link creation, join, and revocation in its audit history.

A revoked, expired, or used-up link stops working immediately; ask an administrator for a new one. Anyone who has an unreserved link can sign in and join, so share it only where you would share membership.

Opening a link shows the organization name, and the team name for a team link. Sign in if asked, then accept deliberately. Joining grants the member role, never administrator, and opening the link again with the same account does not take another use. A reserved link requires the signed-in email to match a listed address exactly, ignoring letter case; otherwise the page asks you to sign out and return with the listed email, or to switch accounts where account switching is enabled.

Agent access

Interactive MCP uses browser OAuth. A compatible external agent can use a claimed WorkOS service_auth registration when the environment has enabled it. CI and unattended jobs use organization API keys.

A claimed registration retains the stable agent identity separately from the person who completed the claim. It is restricted to the exact organization in the access token, recognized scopes, and that person's current Shiplet membership and grants. Anonymous registrations and durable WorkOS agent API keys are not accepted in this release.

Artifact and custom widget code never receive WorkOS sessions, agent registration credentials, organization API keys, or ambient browser credentials.

Next: review API key guidance or prepare an organization-visible artifact.