> ## Documentation Index
> Fetch the complete documentation index at: https://docs.worksong.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Teams, viewers, guests and column permissions

> Give a team access to a board, invite viewers and guests, and hide a column or make it read-only.

Besides the Read, Write and Manage access you give to each person (see [People and permissions](https://docs.worksong.ai/work/people-and-permissions.md)), Work has three more ways to say who sees and changes what: **teams**, **access levels** and **column permissions**.

## Where to find them

* **Teams and access** is in Work's list. It opens Settings, Organization.
* **Share and access** is in a board's options and in the Boards list row menu. You need Manage. It shows the teams that reach the board, and lets you give a team Read, Write or Manage on it, or remove a team.
* **Who can see this** is in a column's menu.
* A member's page sets that member to viewer or guest.

## Teams

A team is a named set of people and Agents. A team holds access like a person does, so one step gives a whole team access to a board. Team names are unique in your company (not case-sensitive). A team member has the role owner or member. You cannot give a team more access than you hold yourself.

A person's access is the sum of their own access and the access of every team they are in. Removing someone from a team, or removing a team's access, takes effect on the next request.

## Access levels

| Level | What it means |
| - | - |
| Member | The default. |
| Viewer | Can only read, whatever access they were given. |
| Guest | Sees only the boards you share with them, and can write on them at most. Access to all boards never reaches a guest, and a guest never manages. A guest can use only a short list of screens and tools. |

The Owner is never limited. Giving a level that cannot use a grant is refused. Changing a person's level rewrites their stored access to fit, and ends their live connections.

## Hide or lock a column

A column can be **hidden** or **read-only** for a person, a team or a whole access level. Open the column's menu and choose **Who can see this**.

* **Hidden.** The values never reach the person: not in the table, a card, an export, a snapshot, search, live updates, an Agent's tool results or an Agent run as that person. The column is left out of the schema they get. A formula that reads a hidden column is hidden with it, and so is a lookup through a hidden Connect column.
* **Read-only.** The person sees the value, but cannot change it.

Filters, sorts, groups and totals use only the columns a person can see, so a query cannot find a hidden value. Being a manager does not lift a restriction. Only the Owner is never restricted.

Some features need to see every cell and are not available to a person with a restriction on the board: comparing and restoring [snapshots](https://docs.worksong.ai/work/board-snapshots.md), moving or copying items, and a dashboard summary written by an Agent.

## Agents

Agents can read and manage all of this: `boardy_list_members`, `boardy_list_teams`, `boardy_list_team_grants`, `boardy_list_column_restrictions`, `boardy_create_team`, `boardy_update_team`, `boardy_remove_team` (with `confirm: true`), `boardy_add_team_member`, `boardy_remove_team_member`, `boardy_grant_team_access`, `boardy_revoke_team_access`, `boardy_set_member_access`, `boardy_restrict_column` and `boardy_unrestrict_column`. They use the same rules as the app, and the same audit log. A guest is never offered these tools. See [Work MCP tools](https://docs.worksong.ai/work/mcp-tools.md).

## API

| Call | Notes |
| - | - |
| `PUT /v1/members/{id}/access` with `{ "access": "viewer" }` | Manage on all boards |
| `GET` or `POST /v1/teams`, `PATCH` or `DELETE /v1/teams/{id}` | |
| `POST /v1/teams/{id}/members`, `DELETE /v1/teams/{id}/members/{memberId}` | People and Agents |
| `GET` or `POST /v1/teams/{id}/grants`, `DELETE /v1/teams/{id}/grants/{grantId}` | |
| `GET /v1/boards/{boardId}/column-restrictions` | Manage on the board |
| `POST /v1/columns/{columnId}/restrictions`, `DELETE /v1/column-restrictions/{id}` | `subjectKind` is `member`, `team` or `tier` |

## Not yet

* A team cannot be the value of a Person column (for assignment or notifications).
* An automation rule or webhook can still name a hidden column, and an AI column can contain a value the Agent saw.
* Inviting a guest by email, with their own login, is not available yet.

<sub>Source: `worksong-ai/worksong:services/work/docs/access-and-teams.md@956ab3b`. Docs version: Worksong 2.0 with Work 1.2.</sub>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.