Access
Members and agents
Manage human members and non-human agents with the same scope model while keeping their user-facing language distinct.
Updated May 23, 2026
Members are humans who belong to workspaces and projects. Agents are runtime identities that can be assigned to projects and resolve secrets through the API. Both can receive roles, but agent secret resolution still requires direct grants.
Members
- Invite members from the Members page.
- Assign workspace or project roles based on the access they should have.
- Use Members, not Users, when talking about workspace and project access in the main app.
- Use Users when talking about billing seats and plan limits.
Agents
- Create agents from the platform action menu or the Agents page empty state.
- Assign agents to projects where they should operate.
- Use OAuth Connect as the default setup path. The agent starts scopehold connect, relays the approval URL and code, and a human approves identity, projects, secrets, and lifetime in the browser.
- Use Agent Key provisioning only as an advanced fallback for CI, scripts, or agents that cannot complete browser approval.
- Grant only the specific secrets the agent needs to resolve.