> ## Documentation Index
> Fetch the complete documentation index at: https://teamcopilot.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions

> Learn how to give access to specific people or everyone for skills and workflows in TeamCopilot.

TeamCopilot lets you control who can use each skill and workflow.

This is useful when:

* only certain people should run a workflow
* only certain teams should use a skill
* you want to make a reviewed resource available to everyone

## Permission modes

Skills and workflows support two permission modes:

* **Restricted**: only selected users can use the skill or workflow
* **Everyone**: anyone in TeamCopilot can use it

For workflows, this controls **run access**.\
For skills, this controls **access** to the skill.

## Before you can change permissions

Permissions can only be changed after the current version of the skill or workflow has been approved.

In practice, that means:

* create or update the skill or workflow
* have an engineer approve it
* then open the permissions editor

If the current code or instructions are still pending approval, TeamCopilot will not let you update permissions yet.

## How approval and permissions interact

Approval and permissions solve different problems:

* approval answers: "is this exact version trusted?"
* permissions answers: "who can use it?"

In practice, a resource usually needs to be approved before you make it broadly available.

## How to manage permissions

1. Open the **Skills** or **Workflows** tab.
2. Find the skill or workflow you want to update.
3. Open **Manage Permissions**.
4. Choose a permission mode:
   * **Restricted (Specific Users)**
   * **Everyone**
5. If you choose **Restricted**, select the users who should have access.
6. Save your changes.

## Giving access to specific people

Use **Restricted** when a skill or workflow should only be available to a defined set of users.

This is the right choice when:

* a workflow can make operational or production changes
* a skill contains sensitive internal procedures
* only a specific team should use the resource

When a resource is restricted:

* only the selected users can use it
* the owner remains included
* the permission list must contain at least one allowed user

In the TeamCopilot UI, the owner cannot be unchecked in restricted mode.

If a resource loses all allowed users, TeamCopilot treats it as locked. That prevents a permission change from bricking access to the resource.

## Giving access to everyone

Use **Everyone** when the skill or workflow is safe and broadly useful across the organization.

This is the right choice when:

* the workflow is low-risk and generally useful
* the skill captures guidance the whole team should follow
* you want to reduce permission management overhead

When a resource is set to **Everyone**, any TeamCopilot user can access it.

## Who can change permissions

Only users who already have access to a skill or workflow can change its permissions.

That means:

* if you can use the resource, you can manage its permissions
* if you do not have access, you cannot change who gets access

If a restricted resource somehow ends up with no allowed users remaining, TeamCopilot treats it as locked and permissions can no longer be modified through the normal UI flow.

## Missing users and missing secrets

The UI also marks a resource as locked or partially unavailable when:

* the resource references users who no longer exist
* the resource requires secrets the current user has not added

This is why a resource listing can show both access state and secret readiness.

## Recommended approach

For most organizations:

* start new skills and workflows as **Restricted**
* give access to the people who should validate them first
* switch to **Everyone** only after you are confident the resource is safe for broader use

This keeps rollout controlled without making the system hard to use.

## A simple rule of thumb

Use **Restricted** for sensitive, high-impact, or team-specific resources.

Use **Everyone** for reviewed resources that are safe and useful across the organization.