Teams: share with a group and grant permissions

Workspaces now have teams, such as sales or operations. An admin groups members into teams on the Members page in Settings. Anyone who owns a specialist, workflow, app, skill, connection, database, store, or browser can share it with a team from the Share dialog they already use for people. Everyone on the team gets the role you pick, including people who join the team later.

How it works

• Access only adds up. Someone gets the highest role that their own share, their teams, the workspace, or the resource's specialist gives, so a viewer share never takes away the editor role their team already gives them.
• A specialist shares everything in it. Whoever a specialist is shared with reaches its workflows, apps, and skills, including ones added later. To keep something to yourself, keep it in a specialist you haven't shared.
• Teams carry permissions. A team can give everyone on it permissions on top of Owner, Admin, or Member, such as editing workspace memory. Nobody can give or take a permission they don't hold. Existing workspace roles became teams with the same people, and apps read a person's teams.
• Conversations stay yours. Sharing a specialist shares its work, never the conversations people have with it, and admins can't read them either.
• Every change is recorded. Each share, team change, and revoke is written to the workspace's permission history with who made it. Leaving a team takes away what it gave.

Also shipped

• Specialists, the geni CLI, and MCP clients see teams, including who reaches what through one, and share with them.
• Another workspace can never tell whether something in yours exists.
• Each member sees and deletes only the platform API keys they created.