# Give an agent Workspace access

> Grant specific files or folders beyond the agent’s Home and control whether it can change them.

Give an agent the smallest set of files it needs. Its own Home always has read and write access; additional grants cannot remove that access.

## Before you begin

You need owner or dashboard editor access to change grants. Review who can use the agent through [team roles](/en/docs/team/roles).

> **Watch out** — Anyone allowed to use an agent can consult, through it, the files it can read. Treat it as a service account when granting sensitive company material.

## Give access

1. Open the agent's **Connections** tab.
2. Select the **Folder or file** plus node.
3. Choose a folder, a file or **Whole Workspace**.
4. Choose **Read only** or **Read and write**.
5. Select **Give access**.
6. Open the new node to check its target and level.

You can change the same grants from the Workspace **Agents** column or **Agent access…** menu. Renaming or moving a granted entry preserves its grant. While the entry is in Trash, access reaches nothing; restoring it restores access.

## Understand the reach

The agent can read and write its Home, reaches shared files at their granted level, and cannot browse other agents' Homes. Ungranted shared files are hidden. COMPANY.md and DESIGN.html are always readable, but agents cannot edit them.

| Grant | What it covers |
| --- | --- |
| Folder | The folder and descendants, including files added later |
| File | That file only |
| Whole Workspace | Shared folders and files; excludes other agents' Homes, Apps/ and hidden run folders |
| Read only | Reading and searching |
| Read and write | Reading and permitted file changes; system protections still apply |

You can hold up to 50 explicit grants, including Whole Workspace. Prefer a parent folder when many files share the same policy. Ancestor folders appear by name for navigation, without exposing their other files.

Overlapping grants use the widest permission. There is no deny rule: a read-only file grant cannot narrow a read-and-write parent grant.

## Narrow access

1. Open the granted node in **Connections**.
2. Change its level, or select **Remove access**.
3. Confirm removal when prompted for **Whole Workspace**.
4. Check for broader grants that still cover the same files.
5. Test the affected task and rerun [evals](/en/docs/agents/evals).

Older agents may retain Whole Workspace read-and-write access. Review their actual grants before assuming isolation.

Workflows reach the common Workspace independently of these grants. An agent executing a workflow step also reaches that workflow's folder during the run.

## Related

- [Workspace](/en/docs/workspace)
- [Workspace paths](/en/docs/workspace/paths)
- [Agent instructions](/en/docs/agents/instructions)