Access
Grant workspace-site roles Data Vault, Files, and Apps. Team membership and M2M are unchanged.
Access (sidebar → Administer) grants workspace-site roles permission to Data Vault collections, Files, and Apps. Pick the role first, then the resource.
This is not Members & Roles. Portal Team stays on workspace SpiceDB. M2M tokens are not Access subjects.
Built-in site admin already has full Vault, Files, and Apps. You do not grant admin here.
Who you grant
| Subject | On Access? |
|---|---|
Site roles from Authentication (viewer, user, custom) | Yes |
Site admin | Implicit full access |
| Portal Team | No — workspace read / write / delete / ddl |
| M2M clients | No — v1 M2M is Team Writer |
What you can grant
| Resource | Scope | Actions |
|---|---|---|
| Data Vault | One collection (table) | read / write / delete |
| Files | Whole workspace | read / write |
| Apps | One product app | launch on the Shell |
New Vault collections default to admin-only until you grant another role. Files grants apply to every file in the workspace. If every non-admin site role can launch an app, it stays workspace-visible; removing a role makes it restricted.
The collection Access dialog on Data Vault is a shortcut for the same Vault grants.
Set grants
Open Access
In the sidebar under Administer, click Access. Select the workspace in the header picker.
Choose a site role
On the right, pick the role (viewer, user, or a custom role). Skip admin.
Add Vault, Files, or Apps
On the left, pick the resource type, then the collection, Files (workspace-wide), or app. Set the action and click Add. Save Access.
Related API
- Access API —
GET/PUT /v1/workspaces/{id}/access - Collection shortcut:
GET/PUT /v1/workspaces/{id}/vault/collections/{name}/acl
Related
- Authentication — site roles
- Data Vault — collection Access dialog
- Files
- Apps — workspace-visible vs restricted
- M2M tokens — Coderunner and CI, not Access