Roles and profiles
A role describes management authority: owner, admin or member. The owner controls the workspace and can delegate particular jobs to admins. A member uses the information and tools they are allowed to access. Admin status does not automatically grant every management permission.
An access profile groups shared areas for a job. An area, called a zone, has rules about reading and changing its records. A profile may add job-specific access alongside the default Everyone profile; direct or group grants can contribute too. Check the combined effective access, meaning what the person can actually do after those assignments are considered.
A Mind set up fresh starts in the Open team arrangement. There, the default Everyone profile gives every member read, suggest, subscribe and task access to eleven shared areas: areas, charter, decisions, inbox, outputs, people, practice, principles, reviews, skills and world-model. Open team also delegates management of access, approvals, automations and loops to admins. A Mind created before that arrangement, or one the owner has switched to Locked down, can differ, so check the person’s effective access rather than assuming it.
In this guide, choose access to fit the work. Team access presets can change defaults and delegations, so a profile name alone is not a complete access check.
These are separate permissions. Reading an area does not give someone every action in it.
See the information.
Read the areas needed for the job.
Suggest a correction.
Propose an edit with its reason.
Approve a change.
Decide a request within your authority.
A person may be allowed to read an area, suggest changes to it, or approve particular requests. These are separate permissions. Choose each for the job, inspect the person’s combined effective access, and check a useful task with their own account.
Two people ask for the same record
people/payroll.mdAgree what the job needs
Name the areas the person needs, what they must do there, and what should stay excluded. Separate reading, suggesting changes and approving requests. For a fictional sales role, that might mean reading customer notes and suggesting updates to them. Whether a suggestion is reviewed first depends on the area: in everyday knowledge areas a member’s suggestion can save as soon as the automatic checks pass, while governed areas such as decisions, charter, principles, skills and practice hold it for a reviewer. Why changes wait for review explains the difference.
Use a member role when the job only needs ordinary use. If administrative work is part of the job, identify the specific management permission rather than broadening authority to solve an unrelated missing read.
Inspect the person in Team access
Open Settings in your Mind’s Portal, its web interface, then choose Members under Workspace. The page is headed Team access. Use the intended person’s account entry and inspect the Access profile selection and Effective access details.
The owner can manage this access. An admin may see the page while its controls remain read-only until the owner delegates access management. Changing roles, approving ordinary changes and managing loops are separate delegations; the settings guide explains why one permission does not imply the others.
Choose the appropriate profile through the available control, then inspect the result again. Remember that assigning an additive profile can keep Everyone access alongside the job-specific areas. Switching the team preset to Locked down does not erase existing individual or group grants.
Check effective access
Have the teammate sign in with their own account. Ask them to open a harmless record in an intended area and complete one useful task. If you are checking a restriction, use disposable test information in the excluded area and verify the refusal.
A profile saved in the owner’s view is not the same observation as a successful task by the teammate. Keep those results separate, just as an invitation, joining and checked access are separate.
If access is refused
Ask which account and Mind the person is using, which area the task needs and which action was refused. Review their effective access and the relevant delegation. If membership has only just changed, check that the Mind recognises the account before changing permissions again.
Do not copy a protected record into chat to work around the refusal. Have the authorised owner or admin correct the intended scope, then repeat the harmless check. Zones and permissions explains what an excluded search result can and cannot tell you.
Review access when the job changes
Revisit the person’s access when responsibilities change. Inspect the resulting effective access after a profile or role change, including defaults and other grants. Removing a person from a particular profile does not by itself prove that every other route of access has gone.
Related
Practical guides for people and agents