Access control

Shiplet evaluates viewing and editing separately through the trusted kernel.

Visibility at a glance

Visibility	Anonymous	Organization	Admin or owner
private	No	Only when granted	Yes
organization	No	Yes	Yes
unlisted	Anyone with the link	Yes	Yes
public	Yes	Yes	Yes

Organization administrators can view private Shiplets. An exact-email invitation becomes effective only for the matching signed-in identity. View access never grants edit access. Owners and admins can edit; other people need an accepted owner or editor grant.

Select an organization or switch identity

Open Account from the header at /account to inspect the signed-in identity. When account switching is enabled, use Switch accounts there to start a different WorkOS identity; otherwise sign out and sign back in. Identity switching does not select an active organization. Open Workspace at /workspace to choose it. Neither action merges Shiplets, teams, grants, or inbox state. To create an organization and team, an owner creates the organization, then creates the team and grants it the narrow viewer, editor, or owner role on the intended Shiplet; team membership alone is not universal edit access.

Invitation consent is exact-email. Open it while signed in with the exact invited email, inspect the offered organization and team or Shiplet access, then accept. On a mismatch, switch accounts or sign out and return as the invited identity; never widen visibility or forward the invitation to bypass consent.

Agent access

A non-interactive key's authority is the intersection of its organization, scopes, project access rules, and the operation's authorization. Prefer Only selected for a bounded job. Use all-project access only for deliberate organization-wide automation; deny rules win.

Interactive MCP should use browser OAuth. Package code never receives a WorkOS session, organization key, or ambient browser credential.

Next: read least-privilege API key guidance or verify the security model.