Administrator access and audit
Who can read each kind of private data, what standing access organization admins hold, and who can use each administrative capability.
Private data and administrator access
| Data | Who can read it |
|---|---|
| A person’s private drive | The person; their own agents (read only); anyone they share with explicitly; anyone running their personal assistant while P-01 is open. Organization admins cannot read it through the drive; whether private-drive metadata is visible through file identifiers is an open runtime test. |
| A personal workspace (private; created at onboarding unless the user joins a mapped organization’s default workspace) | The person; organization admins and owners by standing access * (P-03) |
| Other private workspaces | Members of the workspace; organization admins and owners by standing access * (P-03) |
| Public workspaces | Members according to role; organization admins and owners; agents owned by organization admins (P-02) |
| Secrets | No one reads a secret’s value. Its owner can use it; applets use secrets bound to them through the application tier. |
| All data | Platform superadmin accounts, by bypass; each use is recorded |
Organization admin standing access covers tasks, agents, files and approvals in organization and workspace scope. It excludes owner-only organization rights, the use of secrets, and resources held in a person’s own scope. An organization admin can also join any non-personal workspace as owner; each use is recorded in the audit log.
Standing access to private and personal workspaces applies unless the private-workspace restriction for organization admins is on (P-03).
Administration and audit
| Capability | Who |
|---|---|
| Sign-in methods, models and feature settings | Setup operator (setup password) |
| Bypass of authorization | Platform superadmin accounts; each use recorded |
| View and delete all sandboxes in the deployment | Any organization owner or admin, in any organization, while the organization infrastructure page is on * (P-09) |
| Organization audit events | Organization owners and admins |
| Workspace audit events | Workspace admins and owners; others see events for resources they can read |
| Join any non-personal workspace as owner | Organization admins and owners; recorded |
Audit records are stored by the application tier. For how admins view and export them, see Audit log.