---
title: "Teams and project access"
description: "Control who can open and change each project with project roles, teams and your organization's default project access."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.myspec.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Teams and project access

Each project decides who can open it and what they can do there. You give
people a **project role** on a project, either one by one or through a
**team**. Your organization also has a **default project access** that applies
to every member on every project.

## How access works

There are three project roles. Each one includes everything the role before it
allows.

| Role | What the app says |
|---|---|
| **Read** | can view everything, but change nothing |
| **Write** | can edit specs, comment and chat with the AI |
| **Admin** | can also change project settings and access |

Your role on a project is the **highest** of:

- your organization's [default project access](#your-organizations-default-project-access),
- the access a project gives you personally, and
- the access a project gives any [team](#teams) you are in.

A few rules always apply:

- **Organization owners and admins are always Admin** on every project.
- **Whoever creates a project gets Admin on it.** Every member can create
  projects, whatever the default project access says.
- **With no role, you can't see the project at all.** It doesn't appear in your
  **Projects** list, you can't open it, and MCP tools answer as if it does not
  exist.
- **With too low a role, MySpec refuses the action** and tells you that you need
  more access from a project admin.

For example: your organization's default is **Read**, and the **Design** team
has **Write** on the "Checkout" project. Jane is in **Design**, so she has
**Write** on "Checkout" and **Read** on every other project.

## What each role can do

| | Read | Write | Admin |
|---|---|---|---|
| Open the project and read its chats, spec files, revisions, attachments and comments | Yes | Yes | Yes |
| See who has access to the project | Yes | Yes | Yes |
| Download spec files, bundles and attachments | Yes | Yes | Yes |
| Start Generate and Edit sessions, send messages and answer the AI, including `/btw` | No | Yes | Yes |
| Rename, archive, unarchive and delete chats | No | Yes | Yes |
| Edit spec files by hand, upload them and rename bundles | No | Yes | Yes |
| Move spec files to the Trash Bin, restore them and delete them permanently | No | Yes | Yes |
| Upload and remove attachments | No | Yes | Yes |
| Write, reply to, resolve and reopen comments, and edit or delete your own | No | Yes | Yes |
| Create, refresh, revoke and delete share links | No | Yes | Yes |
| Create and update artifacts through the [MCP tools](/mcp/tools/) | No | Yes | Yes |
| Edit the project's details, archive, unarchive and delete the project | No | No | Yes |
| Add, edit and remove the project's MCP servers | No | No | Yes |
| Choose the project's Custom Skills | No | No | Yes |
| Give, change and remove access to the project | No | No | Yes |

The project's MCP servers and Custom Skills are used in every session in the
project, whoever sends the message.

## Your organization's default project access

The default project access is the role every member has on every project,
before any team or personal access. Organization owners and admins always have
Admin, whatever it says. A new organization starts at **Write**.

Only organization owners and admins can change it.

1. **Open the setting**

   Open the avatar menu and choose **Organization settings**. Find the
   **Default project access** card.
2. **Pick a role**

   Choose a **Default role**: **No access**, **Read**, **Write** or **Admin**.
3. **Save**

   Select **Save**. If you picked a lower role than before, MySpec asks first,
   for example **Lower the default to Read?**: "Every member who has no team or
   personal access to a project loses what this removes, on every project, at
   once. Org owners and admins are not affected." Select **Save** again to
   confirm.

| Default role | What every member gets on every project |
|---|---|
| **No access** | Nothing. Members only see the projects they are given access to, directly or through a team. |
| **Read** | They can open every project and read everything, but change nothing unless a project gives them more. |
| **Write** (default) | They can edit specs, comment and chat with the AI on every project. Only Admins change project settings and access. |
| **Admin** | They can do everything on every project, including changing who has access. |

Teams and personal access can raise a member's role on a project, never lower
it below the default.

## Teams

A team is a named group of members of your organization. When a project gives
a team a role, every member of the team gets that role on the project. Teams
save you from giving the same people access to project after project.

Only organization owners and admins manage teams. Open the avatar menu, choose
**Organization settings**, and find the **Teams** card. Each team shows its
number of members and its description, with **Members**, **Edit** and
**Delete** buttons.

### Create a team

1. **Start**

   In the **Teams** card, select **New team**.
2. **Name it**

   Enter a **Name** and, if you like, a **Description (optional)**.
3. **Create it**

   Select **Create**. Team names must be unique: if the name is in use, MySpec
   says **A team with this name already exists.**

A new team has no members and no access to any project yet.

### Rename a team

Select **Edit** next to the team, change the **Name** or the description, then
select **Save**.

### Add or remove members

Select **Members** next to the team.

- **To add someone**, choose them under **Add a member** and select **Add**. The
  list offers only people in your organization who are not in the team yet.
- **To remove someone**, select **Remove** next to them and confirm. MySpec
  warns: "They lose any project access they had only through this team."

### Delete a team

Select **Delete** next to the team and confirm. MySpec warns: "Its members lose
any project access they had only through this team."

## Give people and teams access to a project

Every project has an **Access** card: "Who can see and change this project."
To find it, open the project's **Settings** tab and select **Access**. It
lists:

- **Everyone in the org**, with your organization's default project access.
- **Org owners and admins: Admin**.
- **Teams** and **People** that the project gives access to, with their role.

Everyone who can open the project can see this list. Only people with **Admin**
on the project can change it, which always includes organization owners and
admins. Anyone else sees each role as a label, without the controls.

Below the card, **People with access** lists everyone who can open the
project, with their role, and **Collaborators** lists everyone who has written
a revision in it.

### Add access

1. **Open the form**

   In the project's **Access** card, select **Add access**.
2. **Choose who**

   Under **Give access to**, choose **Person** or **Team**, then pick one. The
   list offers only people and teams that have no access on this project yet.
3. **Choose the role**

   Pick a **Role**: **Read**, **Write** or **Admin**. **Write** is selected for
   you.
4. **Add it**

   Select **Add**. You see **Access updated**.

### Change or remove access

- **To change a role**, pick a new role next to the team or person. MySpec
  asks, for example **Change Jane's role to Read?**. Select **Change role**.
- **To remove access**, select **Remove** next to the team or person and
  confirm. Removing access never takes anyone below the default project
  access: a person keeps "any access the org default role or their teams give
  them".

If you are no longer an Admin on the project when you make a change, for
example because someone changed your role while the page was open, MySpec
refuses it with **Only project admins can change access.**

Because organization owners and admins are always Admin, a project always has
someone who can manage its access, even if you remove your own.

## What Read users see

With **Read** access you can open the project and read everything in it, but
MySpec hides or locks what you can't change:

- **In a project**, a notice under the top bar says "You have read-only access
  to this project. Ask a project admin for Write access to make changes." on
  every tab. There is no button to start a chat and no **Share** button. A chat
  card's menu offers only **Download**, for completed chats.
- **In the file explorer**, you can open files and revisions and download them.
  There is no upload, no **Edit manually**, no **Move to Trash**, no
  **Restore** and no **Delete permanently**.
- **In a chat**, a **Read-only access** banner sits above a locked message box:
  "You have read-only access to this project. Ask a project admin for Write
  access to chat with the AI." The AI's questions and review cards are shown,
  but you can't answer them. On a new chat, you can't choose **Generate** or
  **Edit**.
- **The spec editor** doesn't open for you. If your role is lowered while you
  have it open, it turns read-only and shows **Read-only access**.
- **In comments** and on the **Discussions** tab, you can read every thread and
  jump to its passage, for example with **Open in file**. There is no
  **Comment** button, and you can't reply, resolve, reopen, edit or delete.

If your role is lowered while a page is open, the next change you try is
refused, for example with "You have read-only access to this project, so this
change wasn't saved. Ask a project admin for Write access." The page then
switches to read-only. Reload the page to see the controls a higher role gives
you.

Below **Admin**, the project's **Settings** menu shows only **General** and
**Access**, **General** shows the project's details read-only, and the Projects
page shows no **More options** menu on the project's card.

## When someone leaves the organization

When a member leaves the organization, or an owner or admin removes them:

- They lose access to its projects in the web app straight away.
- MySpec takes them out of every team in that organization.
- MySpec removes the access that projects gave them personally.

If they join the organization again later, give them access again.

## API tokens and connected apps

An [API token](/mcp/api-tokens/) or a connected app, such as Claude or ChatGPT,
acts as you. It has your role on each project and can never do more than you
can.

- A **Read only** API token acts as **Read** on every project, even where you
  are Admin. So does an app you connected without ticking **Also make
  changes**.
- A **Read and write** token, or an app connected with write access, has your
  own role on each project.

`list_projects` and `get_project` show your role on each project as
`viewer_role`. A tool that needs more than your role fails with a message that
names the role it needs; see
[Project roles and MCP tools](/mcp/tools/#project-roles).

## Notifications

MySpec only sends notifications about a project's comments and sessions to
people who can open the project. If you mention someone in a comment who has no
access to the project, they are not notified.

## When changes take effect

Changes to roles, teams and the default project access apply to the next thing
a person does. A few things can outlast a change for a while:

- A page or client that is already following a project's live updates can keep
  receiving them for a while after access is removed.
- A [stream token](/mcp/stream-tokens/) keeps working until it expires or is
  revoked. Revoke the person's stream tokens if they must stop at once.
- A time-limited download link keeps working until it expires. So do the links
  created for **Build with your favourite tool** and **Generate AI Prompt**.
- When someone's organization role changes, for example from admin to member,
  the change can take a short time to reach their project access.

## Tips

- **Keep the default at Read or Write.** With **Admin** as the default, every
  member can change who has access to every project.
- **Give Admin through a team.** For example, a "Project leads" team with Admin
  on the projects it runs. When a lead changes, update the team, not every
  project.
- **To keep a project private to a few people**, set the default project access
  to **No access**, then give teams or people access project by project.
- **Before you lower the default**, give teams access to the projects they
  still need, so nobody loses access by surprise.
- **Use Read only tokens** for agents that only read. See
  [Security and privacy tips](/help/security/#give-the-least-access-that-works).

Source: https://docs.myspec.dev/guides/teams-and-project-access/index.mdx