Permissions
Owners run the Workspace. Members use what is shared with them. Everyone's AI sees exactly what they can see, and nothing more.
Last verified: 2026-09-29
CompanyOS permissions come from Workspace membership and role. The same rules apply in the web app, in search, and in every connected AI Client.
Roles
| Owner | Member | |
|---|---|---|
| Read Company Files | Yes | Yes |
| Add Personal Files | Yes | Yes |
| Add, move, or delete Company Files | Yes | No |
| Write Procedures and Templates as Personal drafts | Yes | Yes |
| Approve shared Procedures and Templates | Yes | No |
| Edit published Company content | Yes | No |
| Schedule a Procedure | Yes | No |
| Connect a Workspace App (SharePoint Online, Recruit CRM, Airtable, Exa) | Yes | No |
| Connect a Personal App (Microsoft 365 Mailbox) | Yes | Yes |
| Invite Members and change roles | Yes | No |
| Manage billing | Yes | No |
A Workspace always keeps at least one Owner. The last Owner can’t be removed or demoted.
What stays private
- Personal Files are visible only to the Member who added them, including from Owners.
- Personal drafts of Procedures and Templates stay with their author until they are shared and approved.
- Personal Connections, such as a Microsoft 365 mailbox, keep their credentials and mail with that Member.
- Chats stay in each person’s own AI account. CompanyOS never sees or shares chat history.
How it is enforced
Every read and every change is scoped to the Workspace on the server, and checked against the caller’s membership and role at the time of the request. IDs supplied by a client are never trusted as authorization. Search applies the same visibility rules before it ranks anything, so a result can never leak a file you can’t open.