For agents and technical readers

Inspect and change effective teammate access

Use the advertised profile tools for an authorised change, then check the result with the intended person’s own account.

Contents

Authority and intent

Verify the Mind and current principal with orient. Record the intended person, areas, allowed actions and exclusions. Read-only inspection and a security-sensitive grant are different steps; obtain the owning human’s specific authorisation before expanding access. Only the owner or a suitably delegated admin may manage ordinary profiles. Approval-bearing profiles remain owner-controlled.

Inspect before changing

Use list_zone_catalog {} and list_access_profiles {} if advertised. Inspect zone eligibility, the existing profile, Everyone/default behaviour, assignments and the returned effective-access explanation. Use actual subject and profile IDs from discovery, never an invented person ID.

A private zone is not shareable through an access profile. A profile with extends_default: true adds to Everyone and verified group zones; a replacement profile behaves differently. Inspect the actual configuration rather than assuming additive access.

Assign an existing profile

After the intended assignment is authorised, the released input shape for assign_access_profile is:

{"subject":"<actual-roster-principal>","profile_id":"<existing-profile-id>"}

To unassign, profile_id can be null, but that does not prove every other grant has disappeared. The owner cannot be assigned a profile. Read and report an actual refusal instead of changing the person’s role to force the operation.

Inspect and verify

Read list_access_profiles again and inspect effective access. Have the intended person use their own account for a harmless permitted task and an intended excluded read. Keep the configuration result and that runtime observation separate. A role/profile label or an owner-side read is not distinct-person acceptance.

Departure and failure handoff

Full departure is not a profile assignment. Have the owner complete account membership removal, local Portal cleanup and any named credential/model-route follow-up. The Portal’s removal can delete local chat history and has partial-surface results; use the human guide rather than inventing a universal revoke API. If a response is lost, reconcile current assignment/membership before repeating a mutation.

Practical guides for people and agents

Start with one useful job

Join the waitlist

Plain text for AI agents. Same content as the human page.

## For agents

- What Mensara is: it gives a team its own Mind, one shared memory for the team and their AI agents, built by Xanadu Labs LLC.
- Status: signup is not open. A person joins the waitlist at https://app.mensara.ai/#waitlist. Agents cannot create an account or sign up.
- How you can help your person: explain what Mensara does, check whether it fits a job their team repeats, and share the waitlist link.
- Agent references: https://app.mensara.ai/llms.txt lists every page as Markdown and the tool input references for connected agents.

---

# Inspect and change effective teammate access

Operating procedures · For agents and technical readers · [How it works](https://app.mensara.ai/how-it-works)

Use the advertised profile tools for an authorised change, then check the result with the intended person’s own account.

[Page as Markdown](https://app.mensara.ai/how-it-works/choose-access-procedure.md)

[Human guide](https://app.mensara.ai/how-it-works/share-work)

## Use the released interface with current authority

Availability: Core0.20.11 / Portal0.3.47 source checked; discover the actual installed client and enabled features.

Who can do this: The connected principal with the permissions named in this procedure

What changes: The procedure explains its actual reads, writes or external effects before action.

Limits: An input accepted by a source schema is not a successful installed-runtime task.; Keep human decisions, client exclusions and pending results explicit.

Verification: Source checked and independently reviewed; scoped runtime receipts are recorded separately.

## Authority and intent

Verify the Mind and current principal with `orient`. Record the intended person, areas, allowed actions and exclusions. Read-only inspection and a security-sensitive grant are different steps; obtain the owning human’s specific authorisation before expanding access. Only the owner or a suitably delegated admin may manage ordinary profiles. Approval-bearing profiles remain owner-controlled.

## Inspect before changing

Use `list_zone_catalog` `{}` and `list_access_profiles` `{}` if advertised. Inspect zone eligibility, the existing profile, Everyone/default behaviour, assignments and the returned effective-access explanation. Use actual subject and profile IDs from discovery, never an invented person ID.

A private zone is not shareable through an access profile. A profile with `extends_default: true` adds to Everyone and verified group zones; a replacement profile behaves differently. Inspect the actual configuration rather than assuming additive access.

## Assign an existing profile

After the intended assignment is authorised, the released input shape for `assign_access_profile` is:

```
{"subject":"<actual-roster-principal>","profile_id":"<existing-profile-id>"}
```

To unassign, `profile_id` can be null, but that does not prove every other grant has disappeared. The owner cannot be assigned a profile. Read and report an actual refusal instead of changing the person’s role to force the operation.

## Inspect and verify

Read `list_access_profiles` again and inspect effective access. Have the intended person use their own account for a harmless permitted task and an intended excluded read. Keep the configuration result and that runtime observation separate. A role/profile label or an owner-side read is not distinct-person acceptance.

## Departure and failure handoff

## Related

- [Choose access for a teammate](https://app.mensara.ai/how-it-works/right-access)
- [Change or remove a teammate’s access](https://app.mensara.ai/how-it-works/change-access)

[Join the waitlist](https://app.mensara.ai/#waitlist)