Accounts, Spaces and billing
How accounts, Spaces and invitations relate to permissions, and why connecting or paying never grants rights over another owner's inputs.
Start with a Space for your agents and their work. Account membership, resource access, and billing each have their own scope.
Accounts and teams
Each person signs in with their own account. An organization uses a team account, where administrators manage members, roles and billing. A team role controls what a member can do in the account, such as inviting members or managing billing. It does not grant rights over another organization's inputs.
Spaces
A Space organizes identities, resources, and permissions for one or more operations. In the release example, the coding agent and release agent have different authority within the same organization.
A Space is not a shared chat or a shared drive. Being in a Space does not let a participant read another participant's inputs. It defines authority and rules; the confidential runtime executes each permitted operation within declared limits. Execution state and cleanup are tracked per operation. A reusable Space does not imply a dedicated or continuously running worker.
Invitations
Invite a participant when the work needs one. The invited person or organization joins under its own identity and then authorizes its own agents or services.
An invitation enables participation within its scope. Using an input, running a task and releasing a result each still need the relevant owner's permission.
Joining, contributing, paying and authorizing
| Act | What it does | What it does not do |
|---|---|---|
| Accepting an invitation | Lets you participate in a Space. | Grant access to other participants' inputs. |
| Contributing an input | Makes your encrypted input available to tasks you permit. | Make it shared agent context. |
| Sponsoring usage | Pays for the execution of the tasks you sponsor. | Grant rights over the inputs or capabilities you pay for. |
| Authorizing a task | Lets a named task use your input and release a defined result. | Authorize anything beyond that task. |
Sponsorship, participation and authority are separate
The sponsoring organization creates or funds the Space and pays for the execution it sponsors. Participants join under their own identities and keep their own credentials and signing keys. Authority over a protected input or a result release comes only from that asset's owner. Being invited, signing in or paying does not, alone, authorize execution, use of a protected asset, or result release.
OAuth is a connection, not a payment
Connecting an agent through OAuth authorizes that client to act within your account's permissions. It does not start a subscription, approve a charge or grant another owner's authority.