Each project decides who can open it and what they can do there. You give people a project role on a project, either one by one or through a team. Your organization also has a default project access that applies to every member on every project.
How access works
There are three project roles. Each one includes everything the role before it allows.
| Role | What the app says |
|---|---|
| Read | can view everything, but change nothing |
| Write | can edit specs, comment and chat with the AI |
| Admin | can also change project settings and access |
Your role on a project is the highest of:
- your organization’s default project access,
- the access a project gives you personally, and
- the access a project gives any team you are in.
A few rules always apply:
- Organization owners and admins are always Admin on every project.
- Whoever creates a project gets Admin on it. Every member can create projects, whatever the default project access says.
- With no role, you can’t see the project at all. It doesn’t appear in your Projects list, you can’t open it, and MCP tools answer as if it does not exist.
- With too low a role, MySpec refuses the action and tells you that you need more access from a project admin.
For example: your organization’s default is Read, and the Design team has Write on the “Checkout” project. Jane is in Design, so she has Write on “Checkout” and Read on every other project.
What each role can do
| Read | Write | Admin | |
|---|---|---|---|
| Open the project and read its chats, spec files, revisions, attachments and comments | Yes | Yes | Yes |
| See who has access to the project | Yes | Yes | Yes |
| Download spec files, bundles and attachments | Yes | Yes | Yes |
Start Generate and Edit sessions, send messages and answer the AI, including /btw |
No | Yes | Yes |
| Rename, archive, unarchive and delete chats | No | Yes | Yes |
| Edit spec files by hand, upload them and rename bundles | No | Yes | Yes |
| Move spec files to the Trash Bin, restore them and delete them permanently | No | Yes | Yes |
| Upload and remove attachments | No | Yes | Yes |
| Write, reply to, resolve and reopen comments, and edit or delete your own | No | Yes | Yes |
| Create, refresh, revoke and delete share links | No | Yes | Yes |
| Create and update artifacts through the MCP tools | No | Yes | Yes |
| Edit the project’s details, archive, unarchive and delete the project | No | No | Yes |
| Add, edit and remove the project’s MCP servers | No | No | Yes |
| Choose the project’s Custom Skills | No | No | Yes |
| Give, change and remove access to the project | No | No | Yes |
The project’s MCP servers and Custom Skills are used in every session in the project, whoever sends the message.
Your organization’s default project access
The default project access is the role every member has on every project, before any team or personal access. Organization owners and admins always have Admin, whatever it says. A new organization starts at Write.
Only organization owners and admins can change it.
Open the setting
Open the avatar menu and choose Organization settings. Find the Default project access card.
Pick a role
Choose a Default role: No access, Read, Write or Admin.
Save
Select Save. If you picked a lower role than before, MySpec asks first, for example Lower the default to Read?: “Every member who has no team or personal access to a project loses what this removes, on every project, at once. Org owners and admins are not affected.” Select Save again to confirm.
| Default role | What every member gets on every project |
|---|---|
| No access | Nothing. Members only see the projects they are given access to, directly or through a team. |
| Read | They can open every project and read everything, but change nothing unless a project gives them more. |
| Write (default) | They can edit specs, comment and chat with the AI on every project. Only Admins change project settings and access. |
| Admin | They can do everything on every project, including changing who has access. |
Teams and personal access can raise a member’s role on a project, never lower it below the default.
Teams
A team is a named group of members of your organization. When a project gives a team a role, every member of the team gets that role on the project. Teams save you from giving the same people access to project after project.
Only organization owners and admins manage teams. Open the avatar menu, choose Organization settings, and find the Teams card. Each team shows its number of members and its description, with Members, Edit and Delete buttons.
Create a team
Start
In the Teams card, select New team.
Name it
Enter a Name and, if you like, a Description (optional).
Create it
Select Create. Team names must be unique: if the name is in use, MySpec says A team with this name already exists.
A new team has no members and no access to any project yet.
Rename a team
Select Edit next to the team, change the Name or the description, then select Save.
Add or remove members
Select Members next to the team.
- To add someone, choose them under Add a member and select Add. The list offers only people in your organization who are not in the team yet.
- To remove someone, select Remove next to them and confirm. MySpec warns: “They lose any project access they had only through this team.”
Delete a team
Select Delete next to the team and confirm. MySpec warns: “Its members lose any project access they had only through this team.”
Give people and teams access to a project
Every project has an Access card: “Who can see and change this project.” To find it, open the project’s Settings tab and select Access. It lists:
- Everyone in the org, with your organization’s default project access.
- Org owners and admins: Admin.
- Teams and People that the project gives access to, with their role.
Everyone who can open the project can see this list. Only people with Admin on the project can change it, which always includes organization owners and admins. Anyone else sees each role as a label, without the controls.
Below the card, People with access lists everyone who can open the project, with their role, and Collaborators lists everyone who has written a revision in it.
Add access
Open the form
In the project’s Access card, select Add access.
Choose who
Under Give access to, choose Person or Team, then pick one. The list offers only people and teams that have no access on this project yet.
Choose the role
Pick a Role: Read, Write or Admin. Write is selected for you.
Add it
Select Add. You see Access updated.
Change or remove access
- To change a role, pick a new role next to the team or person. MySpec asks, for example Change Jane’s role to Read?. Select Change role.
- To remove access, select Remove next to the team or person and confirm. Removing access never takes anyone below the default project access: a person keeps “any access the org default role or their teams give them”.
If you are no longer an Admin on the project when you make a change, for example because someone changed your role while the page was open, MySpec refuses it with Only project admins can change access.
Because organization owners and admins are always Admin, a project always has someone who can manage its access, even if you remove your own.
What Read users see
With Read access you can open the project and read everything in it, but MySpec hides or locks what you can’t change:
- In a project, a notice under the top bar says “You have read-only access to this project. Ask a project admin for Write access to make changes.” on every tab. There is no button to start a chat and no Share button. A chat card’s menu offers only Download, for completed chats.
- In the file explorer, you can open files and revisions and download them. There is no upload, no Edit manually, no Move to Trash, no Restore and no Delete permanently.
- In a chat, a Read-only access banner sits above a locked message box: “You have read-only access to this project. Ask a project admin for Write access to chat with the AI.” The AI’s questions and review cards are shown, but you can’t answer them. On a new chat, you can’t choose Generate or Edit.
- The spec editor doesn’t open for you. If your role is lowered while you have it open, it turns read-only and shows Read-only access.
- In comments and on the Discussions tab, you can read every thread and jump to its passage, for example with Open in file. There is no Comment button, and you can’t reply, resolve, reopen, edit or delete.
If your role is lowered while a page is open, the next change you try is refused, for example with “You have read-only access to this project, so this change wasn’t saved. Ask a project admin for Write access.” The page then switches to read-only. Reload the page to see the controls a higher role gives you.
Below Admin, the project’s Settings menu shows only General and Access, General shows the project’s details read-only, and the Projects page shows no More options menu on the project’s card.
When someone leaves the organization
When a member leaves the organization, or an owner or admin removes them:
- They lose access to its projects in the web app straight away.
- MySpec takes them out of every team in that organization.
- MySpec removes the access that projects gave them personally.
If they join the organization again later, give them access again.
API tokens and connected apps
An API token or a connected app, such as Claude or ChatGPT, acts as you. It has your role on each project and can never do more than you can.
- A Read only API token acts as Read on every project, even where you are Admin. So does an app you connected without ticking Also make changes.
- A Read and write token, or an app connected with write access, has your own role on each project.
list_projects and get_project show your role on each project as
viewer_role. A tool that needs more than your role fails with a message that
names the role it needs; see
Project roles and MCP tools.
Notifications
MySpec only sends notifications about a project’s comments and sessions to people who can open the project. If you mention someone in a comment who has no access to the project, they are not notified.
When changes take effect
Changes to roles, teams and the default project access apply to the next thing a person does. A few things can outlast a change for a while:
- A page or client that is already following a project’s live updates can keep receiving them for a while after access is removed.
- A stream token keeps working until it expires or is revoked. Revoke the person’s stream tokens if they must stop at once.
- A time-limited download link keeps working until it expires. So do the links created for Build with your favourite tool and Generate AI Prompt.
- When someone’s organization role changes, for example from admin to member, the change can take a short time to reach their project access.
Tips
- Keep the default at Read or Write. With Admin as the default, every member can change who has access to every project.
- Give Admin through a team. For example, a “Project leads” team with Admin on the projects it runs. When a lead changes, update the team, not every project.
- To keep a project private to a few people, set the default project access to No access, then give teams or people access project by project.
- Before you lower the default, give teams access to the projects they still need, so nobody loses access by surprise.
- Use Read only tokens for agents that only read. See Security and privacy tips.