> ## Documentation Index
> Fetch the complete documentation index at: https://getskydive.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions & visibility

> Who can see an agent, who can use it, and who can change it

Every agent has a visibility setting that decides who can find it and who can put it to work. A new agent is visible to your whole workspace by default. You can make it private, scope it to a team, or open it to anyone.

## Visibility tiers

Each agent sits in one tier at a time.

| Tier                   | Who can see it             | Who can message it                              |
| ---------------------- | -------------------------- | ----------------------------------------------- |
| **Private**            | Just you                   | Just you                                        |
| **Team**               | The agent's team           | The agent's team                                |
| **Internal** (default) | Everyone in your workspace | Everyone in your workspace                      |
| **External**           | Everyone in your workspace | Anyone, including people outside your workspace |

**Private** keeps an agent to yourself, for setup or for work only you should touch. **Team** scopes it to one [team](/docs/workspaces/teams) inside a larger workspace. **Internal** is the default: any workspace member can find the agent and put it to work. **External** opens the agent to people outside your workspace, who can email or message it without a Skydive account.

<Note>
  Workspace owners and admins can always see, message, and edit every agent in the workspace, whatever its tier.
</Note>

## See, use, edit

Visibility answers who can *reach* an agent. It is separate from who can *change* one.

* **See and use** is set per agent, by the tiers above.
* **Edit** covers the persona, connections, secrets, and routines. Workspace [roles](/docs/workspaces/rbac) decide who has it.

Someone can use an agent every day without being able to change how it behaves. That is the normal arrangement for a shared team agent.

## Changing an agent's visibility

Open the agent, click the **⋮** menu, and pick a tier under **Manage privacy**. The change takes effect right away. When you lower an agent's visibility, anyone who lost access stops seeing it on their next view refresh.

## Sharing an agent

In the same **⋮** menu, choose **Share** for a link to the agent's profile, plus a profile card you can download as an image. Whether a teammate can open the link depends on the tier. Share an **internal** or **team** agent inside your workspace. Set an agent to **external** before sharing it outside.

<Warning>
  An **external** agent can be messaged by anyone who reaches it, including unidentified senders over email or text. Use it for agents meant to face customers or the public, not for anything that touches private workspace data.
</Warning>

## Visibility and shared memory

Visibility and [memory](/docs/agents/memory) go together. Everyone who can message an agent draws on the same memory. A **team** or **internal** agent is a shared space: knowledge one person teaches it helps everyone. Keep private or sensitive details out of a shared agent, and use a **private** agent when the work should not be visible to the rest of the workspace.

## What an agent itself can reach

Visibility governs people. What the *agent* can reach is a separate question, answered by the credentials you connect and the proxy that holds them.

<CardGroup cols={2}>
  <Card title="Integration permissions" icon="shield-halved" href="/docs/integrations/permissions">
    How credentials are scoped, and why the agent never sees a raw token.
  </Card>

  <Card title="Roles in your workspace" icon="users-gear" href="/docs/workspaces/rbac">
    Owner, admin, and member, and what each can do.
  </Card>
</CardGroup>