# Access and ownership

> Separate account ownership, member permission and the identity used by each tool.

Business files, agents, connections and credentials belong to the account. Member access controls who can use them; a tool binding controls which external identity performs the work.

## Follow the identity chain

The account owns a connection or credential profile. An agent or workflow step binds that identity. The requesting member must also have access to the agent or app they use.

For example, a sales agent can read mail as sales@ while a workflow's sending step uses support@. Workflow identities are selected per step. Neither path borrows a member's personal connection.

If the dashboard Assistant has several compatible identities and you have not named one, it asks you to choose. One compatible identity is selected automatically. The choice applies to those calls, not a hidden account-wide default.

## Member access and resource access

Owners and dashboard users can chat with every active account agent. Members without dashboard access need agent grants through their roles. App roles are separate from dashboard access.

Agents read and write their own Home plus granted Workspace files and folders, with each grant's access level. Workflows reach the common tree. Agents cannot read app source; they use attached app functions.

Access is checked when work executes. Losing an agent grant hides its conversations and blocks history and attachment reads; retained history returns if access is restored.

## Credentials and governance

Owners and editors can connect workspace accounts and create or edit credential profiles. Only the owner can explicitly reveal a stored credential value. Stored values are not returned to editors or the Assistant.

> **Owner only** — Billing, member invitations, spend limits and granting Editor-level dashboard access remain owner responsibilities.

## Related

- [Permissions](/en/docs/reference/permissions)
- [Roles](/en/docs/team/roles)
- [Connected accounts](/en/docs/tools/connected-accounts)
- [App access](/en/docs/apps/access)