Roles and permissions
Every role in Mycorr, and who can do what, in one place. Roles are granted at three levels, organization, space and model, and a single table can also be shared on its own.
Two rules hold across every level:
- A role on a space reaches every model inside it, including models created later and the Open spaces nested beneath it. A direct share on a model reaches that model only.
- Governing is not reading. Organization owners and admins govern every space, but they read a space's data only after granting themselves access, which everyone can see and the governance log records.
Organization roles
| Owner | Admin | Member | |
|---|---|---|---|
| Create a top-level space | Yes | Yes | Yes |
| Work in the spaces they are granted | Yes | Yes | Yes |
| Invite and remove members | Yes | Yes | — |
| Govern every space: manage access, appoint a manager, delete, unseal | Yes | Yes | — |
| See Governance, Plan & usage and Model providers | Yes | Yes | — |
| Set model provider keys and spending limits | Yes | Yes | — |
| Change roles | Yes | — | — |
| Buy, change or cancel the plan; manage cards and invoices | Yes | — | — |
| Schedule the organization for deletion | Yes | — | — |
| Cancel a scheduled deletion | Yes | Yes | — |
A personal organization has one member, you, as its owner. See Organizations.
Space roles
| Manager | Collaborator | Viewer | |
|---|---|---|---|
| Open the space and its models | Yes | Yes | Yes |
| Create models in it | Yes | Yes | — |
| Edit the tables of its models | Yes | Yes | — |
| Own its models: share, move and delete them | Yes | — | — |
| Grant and revoke access to the space | Yes | — | — |
| Create Open spaces inside it | Yes | — | — |
| Seal the space while it is empty, or delete it | Yes | — | — |
A guest, someone outside a personal organization given a role on one of its spaces, can be a collaborator or a viewer, never a manager. See Spaces.
Model roles
| Owner | Collaborator | Viewer | |
|---|---|---|---|
| Who | The managers of the model's space | Granted on the space or the model | Granted on the space or the model |
| Open the model and read its tables | Yes | Yes | Yes |
| Edit tables; create, checkpoint and release them | Yes | Yes | — |
| Upload files, paste tables and import Mycorr tables into the model | Yes | Yes | — |
| Import and sync tables from connections | Yes | — | — |
| Share the model, move it, delete it | Yes | — | — |
See Share a model.
Table permissions
A table shared on its own gives its recipient a permission on the table's release, never on your model:
| Can Import | Can Share | |
|---|---|---|
| Import the release into their own models | Yes | Yes |
| Share it on, with Can Import | — | Yes |
Only the table's owners, the owners of its model, give Can Share or revoke access. See Share a table.
Who can do what
| Task | Who can |
|---|---|
| Create an organization | Anyone, up to 2 free and 5 paid owned |
| Create a top-level space | Any member of the organization |
| Create an Open space inside a space | The space's managers, and anyone they give that right to |
| Seal a space | Its managers, while it is empty |
| Unseal a space | Organization owners and admins |
| Delete a space | Its managers, or organization owners and admins |
| Create a model | The space's managers and collaborators |
| Move a model to another space | Someone who manages both spaces |
| Delete or restore a model | Its owners |
| Create an empty table with New Table | Anyone who can edit the model |
| Delete or restore a table | Anyone who can edit the model |
| Upload a file, paste a table, or import a Mycorr table | Anyone who can edit the model |
| Import a table from a connection, or sync one | The model's owners |
| Take an imported table's newer release | Anyone who can edit the model |
| Checkpoint, release or unrelease a table | Anyone who can edit the table |
| Create or delete a link | Anyone who can edit either table; see Links |
| Run a recipe into a model | Anyone who can edit the model, who can read the recipe's inputs |
| Export a table | Anyone who can read its values, outside a Sealed space |
| Add a connection | Any member; only you can see and use it |
| Connect an AI assistant or create a token | Anyone; it acts with your own permissions |
| Invite members | Organization owners and admins |
| Manage billing | Organization owners |
Through AI assistants and tokens
An assistant connected through the MCP server, and a personal access token, act as you: they can do what you can, and no more. On top of that:
- Read-only connections and tokens cannot change anything.
- A connection to an organization can read your personal models but never write to them.
- Nothing in a Sealed space is reachable by an assistant.
- An assistant cannot delete tables, other than recipe results, or remove attachments or links a person drew.