Permissions and sharing

Share Projects with viewer access and control which accepted resources an Agent can use.

Clawdi sharing is Project-based. A Project owner can grant viewer access through an invitation or share link. Viewers can read supported Project resources but cannot change them.

Understand viewer access

Viewer access includes more than a list of Project names:

• Viewers can list and read Project Skills.
• Viewers can see Vault key names associated with the Project.
• Authorized CLI and Agent runtime paths can resolve Vault values from a shared Project, while the dashboard does not reveal the plaintext values.
• Only the owner can add, edit, or remove the Project’s Skills and Vault data.

Share a Project only when the recipient should be able to use all supported resources in that Project. A hidden Vault value is still usable by an authorized runtime after the recipient explicitly attaches or selects the Project.

Invite one person

clawdi project invite <project> --email <[e-mail]>
clawdi project invites <project>

The recipient reviews and accepts or declines the invitation from their inbox:

clawdi inbox
clawdi inbox accept <invitation-id>
clawdi inbox decline <invitation-id>

Accepting creates viewer membership. It does not download Skills or attach the Project to an Agent.

Create a share link

clawdi project share <project> --label "Team review"
clawdi project share-links <project>

Treat an active share URL as an invitation that can be forwarded. Turning off a link prevents future acceptance but does not remove people who already joined:

clawdi project share-links <project> --revoke <link-id-or-prefix>

Use an accepted Project with an Agent

Sharing grants membership only. The recipient chooses whether a particular Agent can read the Project:

clawdi agent projects attach <agent-id> --project @<owner>/<project>
clawdi agent projects list <agent-id>

Attaching a Project does not make it the Agent’s default-write Project. Agent Project and attachment behavior is the same canonical model wherever the supported Agent workflow exposes these controls.

Remove access

The owner can remove one accepted viewer:

clawdi project members <project> --remove <[e-mail]>

The recipient can leave:

clawdi project leave @<owner>/<project>

The owner can revoke links, cancel invitations, and remove all accepted viewers in one action:

clawdi project unshare <project>

Removing membership stops future access and removes affected Agent attachments. Revoking only a link is not a substitute for removing an existing member.

Review before sharing

1. Open the Project and review every Skill and attached Vault.
2. Use a directed invitation when you know the recipient’s account email.
3. Label share links so you can identify and revoke them later.
4. Review clawdi project members, project invites, and project share-links after the collaboration ends.
5. Detach resources from an Agent when it no longer needs them, even if the person should remain a Project viewer.