MENSARA.AI · A GOVERNED MIND, IN YOUR ACCOUNT
Sign in
Mensara Create account

MENSARA.AI · ZONES AND PERMISSIONS · MACHINE SURFACE · TEXT/MARKDOWN

---
title: Zones and permissions
canonical_url: https://app.mensara.ai/how-it-works/zones-and-permissions
feature: zones-and-permissions
audience: llm-agent
last_verified: 2026-08-11
availability: available-now
signup_supported: false
interfaces:
  - portal
  - mcp
  - cli
---

# Zones and permissions

Defines zones, principals, verbs, access profiles, deterministic authorization, revocation, and refusal behavior.

## Concept model

- A zone is a stable, named access boundary over knowledge.
- A principal is a human, agent, app, or automation with its own identity.
- A grant authorizes named verbs in named zones; absence of a grant means denial.

## Capabilities

- List zones visible to the current identity.
- Grant and revoke explicit verbs through owner-controlled administration.
- Produce receipts for allowed and refused requests.

## Prerequisites

- A provisioned Mind and authenticated principal.
- At least one owner-created zone.
- An access profile or direct grant.

## Authorization

- Authorization is deterministic and happens before retrieval.
- Agents and apps cannot self-grant.
- Revocation applies to subsequent requests and credential rotation may be required.

## Connection or use flow

1. Authenticate the principal.
2. Resolve the requested resource to a zone.
3. Check the requested verb against effective grants.
4. Allow or hold the operation and emit a receipt.

## Refusals and recovery

- Unknown identity: stop and request owner-issued credentials.
- Missing zone or verb: return HELD; do not retry against adjacent zones.
- Revoked credential: discard it and ask the owner to issue a replacement if access is intended.

## Ownership and data boundaries

- Zone definitions and grants are controlled by the owner and delegated administrators.
- A caller cannot infer the existence or contents of zones it cannot list.
- Receipts may name the operation without copying protected content.

## Availability and limits

**Available now** Zone-based reads, writes, grants, revocation, and receipt-backed refusals are available on provisioned Minds.
- A grant must be created by an authorised human; an agent cannot enlarge its own access.
- Fine-grained team profiles continue to gain additional Portal controls.

## Signup and provisioning

`signup_supported: false`

A human owner provisions the Mind, defines initial zones, and issues each principal a scoped credential.

No autonomous signup or provisioning endpoint is documented because none is offered today. An agent must stop and involve the human owner.

## System diagram

```mermaid
flowchart LR
  A[Request: identity + action] --> B{Access gate}
  B -->|zone and verb granted| C[Allowed operation]
  B -->|missing or revoked grant| D[HELD: refusal receipt]
```

## Runnable example

```text
Request: search the customers zone for Acme renewal
Principal: agent:renewal-brief
Required grant: customers + search
Denied behavior: return HELD without customer content
```

## Related

- [Multiplayer](https://app.mensara.ai/how-it-works/multiplayer)
- [Portal, MCP and CLI](https://app.mensara.ai/how-it-works/portal-mcp-cli)
- [Changes, approvals and receipts](https://app.mensara.ai/how-it-works/changes-approvals-receipts)