Skip to content
BotCircuits Space

Administration Govern and monitor

Who can use what

Decide which special tools and integrations are available to everyone, and which only to certain groups.

For Org Admins and Group Admins

Space gives you two levers for controlling capabilities: tool policy for built-in special tools, and integration access for connected apps. Both follow the same idea: the organization sets the outer limit, and groups can only narrow it.

Organization policyGroup narrows itPerson gets the resultAgents act as that person

Special tools

The built-in special tools are web search, the browser and the code sandbox. Under Admin › Tool policy, an Org Admin can:

  • Switch each tool on or off for the whole organization.
  • Allow it only for certain groups.
  • Limit web search and the browser to approved websites (an allowlist).

A Group Admin can narrow what their group gets under Groups › your group › Tool access.

A tool that's off doesn't appear in the + menu and can't be used by that person, or by their agents. The rule is rechecked every time a tool runs, not just when a chat starts.

Special tools always ask for approval when used in chat. See Approvals.

Integrations

Every integration is on for everyone by default, including any added later. On the Integrations page, the Access tab shows one row per integration. For each, an Org Admin picks:

  • Everyone, or
  • Only these groups…, with the groups ticked.

An integration's access covers everything it does: chats, playbooks, automations, actions and triggers. There's no separate switch. Turning it off takes effect immediately, since access is rechecked on every action and every trigger.

A Group Admin can turn an integration off (or back on) for their group, within what the organization allows. One the group isn't allowed shows as Not available to this group.

Org Admins add the connections themselves, and every new connection belongs to the organization. The Plugins tab lets admins manage which integration types exist.

Who ends up with an integration?

A person has an integration when either:

  • It's open to everyone and they're in no group that turned it off, or
  • At least one of their groups is allowed it and hasn't turned it off.

Org Admins always have it.

Approvals as a policy tool

Each connection's actions have approval settings (Don't ask, Ask when it leaves the organization, Always ask). Setting these thoughtfully is one of the best safety measures you have. Likewise, mark sensitive tools, MCP servers and skills as Requires approval. See Integrations and Tools.

Access to knowledge and data

These are controlled per resource through scope and sharing, not through policy:

  • Files by owner and explicit shares.
  • Knowledge bases narrow, but never widen, access.
  • Tables by levels (None, View, Edit, Manage).

See Sharing and access.