Roles
Both roles can add a Member. Only an Admin can create another Admin or take the role away.
Anyone you add has to already be a workspace member. Agents can hold access to other Agents as well as people — an Agent on the list is marked Agent.
Workspace-wide access
Instead of naming people one by one, an Admin can grant access to everyone in the workspace. The list then collapses to the named Admins plus a single Everyone else in workspace row, and the grant includes future workspace members — people who join later get access without anyone adding them. Only an Admin can switch it on, and only an Admin can Remove workspace access to switch it back off. Turning it off leaves the named members untouched.Restrictions
The following restrictions protect continued access to Agent management:- An Agent needs at least one human admin. The last human Admin cannot be demoted, removed, or leave. An Agent that holds the Admin role does not satisfy this — an Admin set with no person in it would leave nobody able to manage the Agent.
- Only Admins can change member roles, and only Admins can remove an Admin.
- Transfer ownership before changing or removing the owner. The Agent’s owner cannot be demoted or removed while they still own it.
- Members can leave when ownership and admin restrictions allow it. Remove myself drops your direct grant. A workspace-wide grant can still give you access.
What someone without access sees
Kylon shows Agent access required, names the person to ask when it can resolve one, and otherwise says to ask an Agent member. The Agent’s directory profile stays visible — enough to know the Agent exists and who to approach — while its bio, skills, sessions, and runtime stay private.Ask for access
If you @mention an Agent you cannot use, Kylon explains that it will not reply and offers Ask for access. The composer can also offer this action before you send. It sends an approval card in a DM to the Agent’s owner, or to its human Admins when the owner cannot grant access. The notice tells you who received the request. Approval adds you as a Member. A request alone grants nothing, and it does not add the Agent to the Room. If nobody can approve, contact a workspace admin for help finding someone who can manage the Agent. An Agent can also prepare an access-change request during a conversation. The person named on the card must approve it; asking an Agent to share itself does not bypass these roles. Manage Admin roles from the Agent’s Access tab; ownership transfers use the Agent’s management controls.Rooms are a separate decision
Room membership governs the conversation; the Agent’s member list governs the Agent. Adding someone to an Agent does not put the Agent in a Room, and Room membership does not by itself grant Agent access. When you add a private Agent to a Room, Kylon lists the Room members who cannot use it yet and asks whether to grant access. Choose:- Grant access and add — add the Agent and put the selected Room members on its access list. Pick this when the Room is meant to work with the Agent.
- Add without access — add the Agent and leave the list alone. The others stay in the Room and still cannot use the Agent.