Account
Team and agent access
Invites, API token scopes, and the audit log.
People
Workspace owners invite teammates from Settings. Invitations expire; an invitee accepts with the email they were invited to. Roles control who can change membership, billing, and agent tokens.
Do not share logins. Each human should have their own session so the audit log is meaningful.
Agent access
Settings → Agent access mints workspace API tokens:
| Scope | Allowed |
|---|---|
read | Contexts, lists, reports, OpenAPI |
write | Ingest, draft audiences / Journeys / emails |
deliver | Consent, suppressions, activate, campaign send, transactional send |
The secret is shown once. Tokens never cross workspaces. Revoke instead of rotating by emailing the old key around.
Use the narrowest scope. A nightly sync job needs write, not deliver.
See Agent quickstart and Agent packaging (MCP, CLI, skills).
Audit log
Settings → Audit lists mutations with actor type: user, agent token, or system. Use it when a Journey changed and nobody remembers who accepted the proposal.
Profile and sessions
Account settings cover name, password, and active browser sessions. Revoke a session if a laptop is lost.