Skip to main content
Besides the Read, Write and Manage access you give to each person (see People and permissions), Work has three more ways to say who sees and changes what: teams, access levels and column permissions.

​
Where to find them

  • Teams and access is in Work’s list. It opens Settings, Organization.
  • Share and access is in a board’s options and in the Boards list row menu. You need Manage. It shows the teams that reach the board, and lets you give a team Read, Write or Manage on it, or remove a team.
  • Who can see this is in a column’s menu.
  • A member’s page sets that member to viewer or guest.

​
Teams

A team is a named set of people and Agents. A team holds access like a person does, so one step gives a whole team access to a board. Team names are unique in your company (not case-sensitive). A team member has the role owner or member. You cannot give a team more access than you hold yourself. A person’s access is the sum of their own access and the access of every team they are in. Removing someone from a team, or removing a team’s access, takes effect on the next request.

​
Access levels

The Owner is never limited. Giving a level that cannot use a grant is refused. Changing a person’s level rewrites their stored access to fit, and ends their live connections.

​
Hide or lock a column

A column can be hidden or read-only for a person, a team or a whole access level. Open the column’s menu and choose Who can see this.
  • Hidden. The values never reach the person: not in the table, a card, an export, a snapshot, search, live updates, an Agent’s tool results or an Agent run as that person. The column is left out of the schema they get. A formula that reads a hidden column is hidden with it, and so is a lookup through a hidden Connect column.
  • Read-only. The person sees the value, but cannot change it.
Filters, sorts, groups and totals use only the columns a person can see, so a query cannot find a hidden value. Being a manager does not lift a restriction. Only the Owner is never restricted. Some features need to see every cell and are not available to a person with a restriction on the board: comparing and restoring snapshots, moving or copying items, and a dashboard summary written by an Agent.

​
Agents

Agents can read and manage all of this: boardy_list_members, boardy_list_teams, boardy_list_team_grants, boardy_list_column_restrictions, boardy_create_team, boardy_update_team, boardy_remove_team (with confirm: true), boardy_add_team_member, boardy_remove_team_member, boardy_grant_team_access, boardy_revoke_team_access, boardy_set_member_access, boardy_restrict_column and boardy_unrestrict_column. They use the same rules as the app, and the same audit log. A guest is never offered these tools. See Work MCP tools.

​
API

​
Not yet

  • A team cannot be the value of a Person column (for assignment or notifications).
  • An automation rule or webhook can still name a hidden column, and an AI column can contain a value the Agent saw.
  • Inviting a guest by email, with their own login, is not available yet.
Source: worksong-ai/worksong:services/work/docs/access-and-teams.md@956ab3b. Docs version: Worksong 2.0 with Work 1.2.