Permission Reference

What you can do in MemoryLake — what pages you can open, what buttons you can click, what API calls succeed — depends on the permissions your team admin has granted you. This page is your guide:

• Each capability is described in plain language with what it lets you do and what you’ll see when it’s missing.
• The exact permission identifier is shown in each entry — copy that to your admin if you need a permission added.

​

How permissions reach you

Permissions reach an individual member through three layers your admin controls:

1. Role — the built-in roles (Owner / Admin / Member) come with a default bundle of capabilities. Owners can also create custom roles by cloning a parent role or starting blank. See Roles and Permissions.
2. Permission policy — Allow / Deny rules layered on top of the role. Admins use these to override role defaults (e.g. let Members create projects).
3. Resource scope — per-member whitelist of specific workspaces, projects, or other resources a member can act on, plus the subset of operations allowed on each. This is how an instance-level capability gets narrowed to one or two workspaces or projects.

API Keys are programmatic identities (Service Accounts) — each one inherits the role and resource scope of the member who created it. Removing a member revokes every key they own.

​

How to spot a missing permission

You don’t have to memorize anything. MemoryLake makes missing permissions visible in predictable ways:

​

How permissions are grouped

Permissions live on five resources. Every capability below belongs to one of them:

​

How permissions are granted

Every capability has a Level — instance or service — that determines whether your admin can narrow it down to specific resources. Each entry below shows the level in its Level line.

---

​

Common role recipes

These are typical capability bundles to use as starting points when you’re either building a custom role or adding permission policies on top of the built-in Member role. They are not pre-built roles — Owners assemble them via Team > Permission Settings, then narrow instance capabilities to the right resources via the member’s Resource Scope when assigning the role.

---

​

Working with workspaces

​

Browse workspaces

Lets you see your team’s workspaces in the list page and workspace switcher. Without it: workspace lists load empty even when you have access to specific workspaces. Identifier: workspace:list Level: service — applies team-wide (not tied to a specific resource instance).

---

​

Create a new workspace

Lets you start a brand-new workspace from scratch. Without it: “New workspace” buttons are hidden or greyed out. Identifier: workspace:create Level: service — applies team-wide (not tied to a specific resource instance).

---

​

Open a workspace

Lets you open a workspace and view its contents. This permission also gates workspace-scoped search — the Search Memories API requires it. Without it: workspace cards appear faded and clicking does nothing. Typing the workspace URL directly shows a full-page “no permission” message. Workspace-level search calls return 403. Identifier: workspace:read Level: instance — granted on a specific workspace.

---

​

Edit workspace settings

Lets you rename a workspace, edit its description, and change its configuration. Without it: all “Rename” and “Edit” options are greyed out wherever they appear. Identifier: workspace:modify Level: instance — granted on a specific workspace.

---

​

Delete a workspace

Lets you permanently remove a workspace. Without it: “Delete” options are greyed out on every workspace card and dialog. Identifier: workspace:delete Level: instance — granted on a specific workspace.

---

​

Managing conversations in a workspace

Conversations are workspace-scoped — they live in a workspace and are linked to one or more projects where extracted facts are stored.

​

List conversations

Lets you see the list of conversations in a workspace. Without it: the conversations area shows an empty state even when conversations exist. Identifier: workspace:conv_list Level: instance — granted on a specific workspace.

---

​

Read a conversation

Lets you open a conversation and read its messages, including batch-fetching multiple messages at once. Without it: conversation rows appear faded; clicking does nothing. Identifier: workspace:conv_read Level: instance — granted on a specific workspace.

---

​

Send a message to a conversation

Lets you append a new message to an existing conversation. Without it: the message input area is disabled and explains it needs the conversation-append permission. Identifier: workspace:conv_append Level: instance — granted on a specific workspace.

---

​

Delete a conversation

Lets you permanently remove a conversation from a workspace. Without it: “Delete” actions on conversations are greyed out. Identifier: workspace:conv_delete Level: instance — granted on a specific workspace.

---

​

Managing actor bindings in a workspace

Actors are created globally, then bound to workspaces to operate within them. These permissions control which actors can participate in a workspace.

​

List workspace actors

Lets you see which actors are bound to a workspace. Without it: the bound-actors list loads empty. Identifier: workspace:actor_list Level: instance — granted on a specific workspace.

---

​

Bind an actor to a workspace

Lets you add an existing actor to a workspace so they can participate in conversations and accumulate facts. Without it: the “Add actor” action is greyed out. Identifier: workspace:actor_bind Level: instance — granted on a specific workspace.

---

​

Remove an actor from a workspace

Lets you unbind an actor from a workspace — they stop participating, but their globally-stored identity and facts remain. Without it: the per-actor “Remove” action is greyed out. Identifier: workspace:actor_unbind Level: instance — granted on a specific workspace.

---

​

Managing actor facts in a workspace

Actor facts are knowledge about a specific person or agent that accumulates across projects within a workspace. These permissions control access to that per-actor knowledge.

​

List an actor’s facts

Lets you see the list of facts that have accumulated for an actor in a workspace. Without it: the actor’s facts area loads empty. Identifier: workspace:actor_fact_list Level: instance — granted on a specific workspace.

---

​

Read an actor fact

Lets you view the full content of a specific actor fact. Without it: fact rows appear faded; clicking does nothing. Identifier: workspace:actor_fact_read Level: instance — granted on a specific workspace.

---

​

Update an actor fact

Lets you edit the content of an actor fact. Without it: “Edit” actions on actor facts are greyed out. Identifier: workspace:actor_fact_modify Level: instance — granted on a specific workspace.

---

​

Forget an actor fact

Lets you permanently remove an actor fact. Without it: “Forget” actions on actor facts are greyed out. Identifier: workspace:actor_fact_delete Level: instance — granted on a specific workspace.

---

​

Managing agent bindings in a workspace

Agents are created globally, then bound to workspaces to serve conversations. These permissions control which agents can operate in a workspace.

​

List workspace agents

Lets you see which agents are bound to a workspace. Without it: the bound-agents list loads empty. Identifier: workspace:agent_list Level: instance — granted on a specific workspace.

---

​

Bind an agent to a workspace

Lets you add an existing agent to a workspace so it can serve conversations. Without it: the “Add agent” action is greyed out. Identifier: workspace:agent_bind Level: instance — granted on a specific workspace.

---

​

Remove an agent from a workspace

Lets you unbind an agent from a workspace — it stops serving conversations, but its global definition and version history remain. Without it: the per-agent “Remove” action is greyed out. Identifier: workspace:agent_unbind Level: instance — granted on a specific workspace.

---

​

A2A protocol operations

​

Use the A2A protocol

Lets you initiate and participate in Agent-to-Agent (A2A) protocol operations within a workspace. Without it: A2A requests to this workspace return 403. Identifier: workspace:a2a Level: instance — granted on a specific workspace.

---

​

Working with actors

​

Browse actors

Lets you see the list of actors available across your team. Without it: actor lists load empty even when actors exist. Identifier: actor:list Level: service — applies team-wide (not tied to a specific resource instance).

---

​

Create an actor

Lets you create a new actor — a person or assistant that can accumulate facts across workspaces and projects. Without it: “New actor” buttons are hidden or greyed out. Identifier: actor:create Level: service — applies team-wide (not tied to a specific resource instance).

---

​

View an actor

Lets you open an actor and see their configuration and details. Without it: actor rows appear faded; clicking does nothing. Typing the actor URL directly shows a “no permission” message. Identifier: actor:read Level: instance — granted on a specific actor.

---

​

Edit an actor

Lets you update an actor’s name, description, and other settings. Without it: all “Edit” options on the actor are greyed out. Identifier: actor:modify Level: instance — granted on a specific actor.

---

​

Delete an actor

Lets you permanently remove an actor. Without it: “Delete” options on actors are greyed out. Identifier: actor:delete Level: instance — granted on a specific actor.

---

​

Working with agents

​

Browse agents

Lets you see the list of agents available across your team. Without it: agent lists load empty even when agents exist. Identifier: agent:list Level: service — applies team-wide (not tied to a specific resource instance).

---

​

Create an agent

Lets you define a new agent with its model, system prompt, and capabilities. Creating an agent automatically creates a corresponding actor. Without it: “New agent” buttons are hidden or greyed out. Identifier: agent:create Level: service — applies team-wide (not tied to a specific resource instance).

---

​

View an agent

Lets you open an agent and see its configuration — model, system prompt, capabilities, and policies. Without it: agent rows appear faded; clicking does nothing. Identifier: agent:read Level: instance — granted on a specific agent.

---

​

Edit an agent’s identity

Lets you update an agent’s identity fields — name, description, and other top-level settings that apply across all versions. Without it: “Edit” options on the agent’s identity are greyed out. Identifier: agent:modify Level: instance — granted on a specific agent.

---

​

Delete an agent

Lets you permanently remove an agent and all its versions. Without it: “Delete” options on agents are greyed out. Identifier: agent:delete Level: instance — granted on a specific agent.

---

​

List agent versions

Lets you see the version history of an agent — each past configuration snapshot. Without it: the versions area loads empty. Identifier: agent:version_list Level: instance — granted on a specific agent.

---

​

Create an agent version

Lets you publish a new version of an agent — a snapshot of updated model, prompt, or capability settings. Without it: the “Publish version” action is greyed out. Identifier: agent:version_create Level: instance — granted on a specific agent.

---

​

View an agent version

Lets you inspect the details of a specific agent version — its model, prompt, and capability configuration at that point in time. Without it: version rows appear faded; clicking does nothing. Identifier: agent:version_read Level: instance — granted on a specific agent.

---

​

Working with projects

​

Browse the project list

Lets you see your team’s projects — in the list page, in the project switcher dropdown, and as cards on the home screen. Without it: project lists are empty even when you have access to specific projects. The project switcher is empty too. Identifier: project:list Level: service — applies team-wide (not tied to a specific resource instance).

---

​

Open a project

Lets you click a project card and view its contents — the project’s home page and every tab inside it. Without it: project cards appear faded and clicking does nothing. Typing the project URL directly shows a full-page “no permission” message. Identifier: project:read Level: instance — granted on a specific project.

---

​

Create a new project

Lets you start a brand-new project from scratch. Without it: “New project” buttons are hidden or greyed out — on the list page, in the first-project onboarding card, in the quick-start wizard, and on the integrations page. Identifier: project:create Level: service — applies team-wide (not tied to a specific resource instance).

---

​

Edit project settings

Lets you rename a project, edit its description, change which industry it belongs to, and share it with others. The “Bind industry” button inside the chat composer also depends on this. Without it: all “Rename”, “Edit”, and “Share” options are greyed out wherever they appear. Identifier: project:modify Level: instance — granted on a specific project.

---

​

Delete a project

Lets you permanently remove a project. Without it: “Delete” options are greyed out on every project card and dialog. Identifier: project:delete Level: instance — granted on a specific project.

---

​

Search across a project (API-only)

Lets you call the Search Memories API to query documents and facts within a project at once. Where this matters: API integrations only. In the console, search inside a project goes through the document-search and fact-search permissions below. Identifier: project:search Level: instance — granted on a specific project.

---

​

Working with documents inside a project

​

See the Files tab

Lets you open the Files tab on a project and browse the documents attached to it. Without it: the entire Files tab disappears from the project’s side menu. Typing the files-page URL just redirects you to the default tab. Identifier: project:doc_list Level: instance — granted on a specific project.

---

​

Read a single document

Lets you fetch full document details through the API. Where this matters: mostly API integrations, plus the console’s background poll that refreshes document processing status. Console file downloads go through the Read your files permission in the Library section. Identifier: project:doc_read Level: instance — granted on a specific project. Covers this API: Get Document.

---

​

Add a document to a project

Lets you bring a file into a project — through the “Add document” button, the empty-state upload card, and the upload icon inside the chat composer. Without it: every “Add document” / upload entry point is greyed out. Identifier: project:doc_add Level: instance — granted on a specific project.

---

​

Remove a document from a project

Lets you take a document out of a project, one at a time or in bulk. Without it: the per-row “Remove” action and the batch-remove action on the Files tab are greyed out. Identifier: project:doc_delete Level: instance — granted on a specific project.

---

​

Search documents inside a project (API-only)

Lets you run semantic search queries over the documents in a project. Where this matters: API integrations only. The console’s in-document search is wired to its own controls. Identifier: project:doc_search Level: instance — granted on a specific project.

---

​

Working with facts inside a project

​

See the Facts tab

Lets you open the Facts tab and see the list of facts along with the keyword cloud at the top. Without it: the entire Facts tab disappears from the project’s side menu. The keyword cloud, conflict list, and the raw change history are all unreachable. Identifier: project:mem_list Level: instance — granted on a specific project.

---

​

Read a fact’s content

Lets you click a fact row to open its detail panel — full content, timestamps, and source information. Without it: fact rows show as faded; clicking does nothing; drilling into a keyword from the cloud also fails. Identifier: project:mem_read Level: instance — granted on a specific project. Covers this API: Get Fact.

---

​

Search facts

Lets you find facts by keyword. The search box at the top of the Facts tab depends on this. Without it: the search box itself is hidden — you can scroll the list but you can’t filter it. Identifier: project:mem_search Level: instance — granted on a specific project. Covers this API: Search Memories.

---

​

Add a fact via API (API-only)

Lets you push a fact in directly through the API. Where this matters: API integrations only. Inside the console, facts are produced automatically from conversations and document ingestion — there’s no manual “add a fact” button. Identifier: project:mem_add Level: instance — granted on a specific project.

---

​

Update a fact

Lets you edit an existing fact’s content. Without it: “Edit” actions on facts are greyed out. Identifier: project:mem_modify Level: instance — granted on a specific project.

---

​

Forget (delete) a fact

Lets you make MemoryLake forget a fact, one at a time or in bulk. Without it: the per-row “Forget” action and the batch-forget action are greyed out. Identifier: project:mem_delete Level: instance — granted on a specific project.

---

​

Resolve conflicting facts

Lets you see the Conflicts tab inside a project, review each conflict, and pick how to resolve it. Without it: the Conflicts tab disappears entirely — you can’t see whether conflicts exist or what they’re about. Identifier: project:mem_conflict_resolve Level: instance — granted on a specific project.

---

​

Managing MCP for a project

An MCP server is the connection point that lets a third-party tool (Claude desktop, an MCP-compatible client, or your own app) talk to a specific project on your behalf. Each MCP server is issued its own credential. The four permissions below split the lifecycle into see / list / create / revoke.

​

See the Integrations tab

Lets you open the Integrations tab on a project — where MCP servers are listed and managed. Without it: the Integrations tab is hidden from the project’s side menu. Identifier: project:mcp_read Level: instance — granted on a specific project.

---

​

View existing MCP servers

Lets you see the list of MCP servers issued for a project, including when each one was created and what it’s named. Without it: the integrations page shows an empty “no permission” state, even when MCP servers exist. Identifier: project:mcp_list Level: instance — granted on a specific project.

---

​

Create a new MCP server

Lets you set up a new MCP server to connect a third-party tool to the project. Without it: the “Add integration” / “Create MCP server” button is greyed out. Identifier: project:mcp_add Level: instance — granted on a specific project.

---

​

Revoke an MCP server

Lets you delete an existing MCP server — immediately disconnecting everything that was using it. Without it: the per-row “Delete” / “Revoke” action is greyed out. Identifier: project:mcp_delete Level: instance — granted on a specific project.

---

​

Working with your Library

Your Library is the shared file space that sits underneath every project. When you “add a document to a project”, the file goes into your Library first and the project just links to it. The four permissions below apply across all your projects at once — they are not granted per project.

​

Read your files

Lets you browse the file tree, see thumbnails, preview files in the viewer, download files, and read the comments people have left on them. Without it: thumbnails fall back to plain file-type icons, “Download” menu items grey out, file previews are skipped, and comment panels degrade silently. Identifier: drive:item_read Level: service — applies team-wide (not tied to a specific resource instance). Covers these APIs: Get Item, List Items.

---

​

Upload and create files

Lets you upload files, create folders, and attach external storage. This is the permission that runs in the background whenever you click “Add document” or drag a file into the app. Without it: “New folder” and “Upload file” entry points are greyed out everywhere, including inside the “Add document” dialog. Identifier: drive:item_add Level: service — applies team-wide (not tied to a specific resource instance). Covers these APIs: Create Upload, Create Item.

---

​

Edit your files

Lets you rename files, move them between folders, edit their metadata and tags, and save comments. This also covers managing custom attributes (xattrs) on files via the API. Without it: rename, move, and edit-metadata options grey out. The “Save” button on the comment panel is disabled and explains it needs the file-edit permission. Identifier: drive:item_modify Level: service — applies team-wide (not tied to a specific resource instance). Covers these APIs: Set Item Xattrs, Delete Item Xattrs.

---

​

Delete files

Lets you permanently delete files and folders, one or in bulk. Without it: all “Delete” actions on files and folders are greyed out. Identifier: drive:item_delete Level: service — applies team-wide (not tied to a specific resource instance). Covers these APIs: Delete Item.

---

​

Quick troubleshooting

---

Looking for a bird’s-eye list of all permissions grouped by area? See the Permission catalog on the Team collaboration overview. If the capability you need doesn’t appear on your role, contact your team’s owner or administrator. They can adjust roles in Teams > My Teams > Members.