Manage access by team
A person, agent, or workload gets the union of every Access Binding that applies to it. You can use that to manage access for several teams with a few layered bindings: one baseline for everyone, and one binding per need that lists every team that shares it. For the access model, see Team Access.
Plan the bindings
Group grants by who needs them, not by team. A set of tools that several teams share is one binding with several subjects, so you edit it in one place. For example:
| Binding | Applies to | Grants | Decision mode |
|---|---|---|---|
baseline | Everyone, through a group every user's IdP token carries | Search, docs, and calendar tools | Allow |
marketing | Marketing team | CMS, analytics, and social tools | Allow |
crm-readonly | Marketing team, Support team | CRM read-only tools | Allow |
finance-sensitive | Finance team | Payments and ledger write tools | Hold |
A member of the Marketing team gets baseline, marketing, and crm-readonly. A member of the Support team gets baseline and crm-readonly. A member of the Finance team gets baseline, and a person approves each call that finance-sensitive covers.
Create the bindings
- Go to Setup → Settings → Access Bindings and select New Access Binding.
- Enter a Name, such as
crm-readonly. You can't rename a binding after you create it. - Under Applies to, add a subject for each team that needs the grant, such as the Marketing and Support teams. For a baseline that everyone gets, add a group subject that every user's IdP token carries.
- Under Models and MCP tools, choose the grants. See Control MCP tool access.
- For a sensitive grant, open Advanced and set Decision mode to Hold, so a person approves each call.
- Select Create. Repeat for each binding in your plan.
The Applies to column of the Access Bindings list shows each binding's subjects, and the number of Workload Blueprints that select it.
Change who gets a grant
- Open the binding's actions menu and select Edit.
- Add or remove subjects under Applies to, or change the grants.
- Select Preview impact, review who gains or loses access, and confirm. The change applies to every subject and workload the binding covers.
To give one more team a shared grant, add the team to that binding. Don't copy its grants into a new binding: two copies drift apart when you edit one.