Skip to main content
Closot
LoginTry for free

Custom Agents Sharing & Permissions 🤖

Custom Agents operate on a dual permission model: there's what the Agent itself can access, and there's who can access the Agent. Both dimensions matter, and understanding how they interact is essential before sharing an Agent broadly with your team.

How Custom Agent Permissions Work​

Every Custom Agent has two independent layers of access control:

  1. What the Agent can access — The specific Closot pages, databases, and connected apps you've explicitly authorized the Agent to use
  2. Who can access the Agent — The people or groups you've shared the Agent with, and what they're allowed to do with it
warning

When you share a Custom Agent, you're giving team members access to everything the Agent can see. Agent users can retrieve information from resources they don't personally have access to, and make edits if the Agent has write permissions to those resources. Review the Agent's access settings carefully before sharing widely.

Example: SupportBot​

Your support team builds a Custom Agent called SupportBot to help customer-facing staff handle escalations quickly.

  • The support team gives SupportBot access to internal pages like response playbooks, escalation templates, and product limitation docs — pages that aren't shared with other teams.
  • Customer-facing staff are given Can view and interact access to SupportBot.
  • Those staff members can now ask SupportBot questions and get grounded, accurate answers from the internal support documentation — without needing direct access to those pages.

This means staff can make better decisions faster, without the support team having to manually field every question.

What Your Custom Agent Can Access​

When creating or editing a Custom Agent, you explicitly configure its access through the Tools and Access settings. A Custom Agent can be given access to:

  • Closot pages and databases — Selected specific pages or entire databases
  • Connected apps — Slack channels, MCP-connected services
  • Permission levels — Can view, Can comment, Can edit

By default, new Agents have no access to any workspace content. Creators must explicitly grant access and acknowledge the implications of doing so.

The Agent uses its own configured access — not the permissions of the person who triggered it. This means if the Agent has broader access than the person using it, the Agent may surface information that user couldn't access directly.

note

Database row-level permissions apply to the Agent's own access, not the triggering user's access. If the Agent can see more rows than the user can, those rows may appear in responses.

Permission-Level Requirements for Granting Access​

  • To give an Agent view access to a resource, you need at least view access to that resource yourself
  • To give an Agent any higher level of access (comment, edit), you need Full Access to that resource
tip

Grant Agents access to only the specific resources they actually need for their job. Avoid giving an Agent workspace-wide access — there's no way to grant higher than "Can View" to all pages at once.

Who Can Access Your Custom Agent​

Share your Custom Agent the same way you share any Closot page — by clicking Share at the top of the Agent page. There are three permission levels for people accessing the Agent:

Can View and Interact​

  • Run the Agent, ask it questions, and receive results
  • View the Agent's Settings, instructions, and connected resources in read-only mode

Can Edit​

  • Everything in Can view and interact
  • Modify instructions and Agent configuration
  • View all conversations users have had with the Agent
  • Add or remove connected Closot pages and databases
  • Cannot edit third-party connections that were set up by someone else

Full Access​

  • Everything in Can edit
  • Share the Agent with other people or groups
  • Delete the Agent

Collaborating on a Custom Agent​

Multiple people can contribute to building and maintaining a Custom Agent. For connections, Closot validates that anyone making edits has the necessary access to the resource being configured.

For example: if you set up a private Slack channel connection that only you can access, other editors can see it listed in the settings but cannot reconfigure or view its details — they can only remove it or set up a new connection with a channel they can access.

Guest and Restricted Member Access​

Guests and restricted members can:

  • View outputs the Agent has posted to Closot pages or databases that are shared with them
  • Make edits to pages or databases that may trigger an already-configured Agent to run

Guests and restricted members cannot:

  • Create Custom Agents
  • Edit Agent settings (unless explicitly given Can edit permission)
  • Ask the Agent questions or receive answers based on what the Agent can access

Workspace Admin Controls​

Workspace admins have dedicated tools for managing Custom Agents across the organization.

Agent Directory​

The Agent Directory gives admins a complete view of every Custom Agent in the workspace.

  • Search and browse all Custom Agents
  • See who created each Agent and when it was last active
  • Disable and re-enable Agent editing, chatting, and triggers to pause automated runs

To access: Settings → Closot AI → Agents tab

Creation Controls​

Restrict who can build new Custom Agents:

  1. Go to Settings → Closot AI
  2. Open the Agents tab and find Control who can create agents
  3. Choose from:
    • All workspace members (default)
    • Workspace owners only
    • Workspace owners + specific groups only

Enterprise Controls​

Content Admin Search​

View and manage the pages and databases that each Custom Agent has access to.

  • See exactly which resources an Agent can read or write
  • Remove an Agent from accessing sensitive content
  • Any page or database owner can remove an Agent from their resource — even without direct access to the Agent itself

To access: Settings → Content search → use the Shared with filter and select a Custom Agent

Activity Log​

A full, filterable history of all Custom Agent actions across the workspace.

  • Filter by Agent, user, date, or action type

To access: Settings → Activity log → filter for Custom Agent events using the Users/Agents dropdown

Ownership Transfer​

When a team member leaves, their Custom Agents need a new owner to keep running. After 7 days without an active owner, an Agent stops running.

  1. Go to Settings → Members → Recently Left tab
  2. Agents from recently departed members will appear in the content re-provisioning flow as "private agents"
  3. Assign a new owner and confirm the transfer

Ownership transfer is also available via the Closot Public API.

FAQs​