Aleph

Organizations and teams

Scopes let people share agents and configuration without flattening ownership or access rules.

Choose a placement

  • Use personal for an agent you alone govern.
  • Use an organization for agents managed through shared roles.
  • Use a team when participation should be limited to a specific group inside an organization.

Organization agents are owned by the organization. createdBy is attribution when present, not a permanent superuser path. Personal agents are owned by their creator.

Roles and permissions

Organizations provide owner, admin, and member roles, plus optional custom roles. Permissions such as agent:read, agent:create, and vault:read are checked against the agent's organization.

Find an organization ID

Open the organization Settings page to view and copy its organization ID. Use this identifier when configuring an organization-scoped integration or automation.

Organization Vault API paths and the Aleph CLI also accept the organization's unique slug. Organization API keys may manage only the Vault belonging to their own organization.

Team agents add a stricter membership check: the active team must match and the user must belong to it. The sidebar team switcher shows only teams the signed-in user belongs to in the active organization. Organization dashboards are labeled Org <name>'s Agents, while team dashboards are labeled Team <name>'s Agents, so the current agent scope stays explicit after switching.

Switching between personal, organization, and team workspaces changes the active authorization identity. The main sidebar shows only that workspace's agents. When you inspect a public agent owned by another workspace, you can view its public sections and install or independently clone it, but you cannot run conversations or use management controls until you switch to its owning workspace and have the required permission.

Organization API keys are machine identities rather than user sessions. They can manage organization- and team-placed agents owned by their organization, including when no user ID is present, and cannot access personal or other-organization agents.

Keep configuration with its owner

Personal, organization, and team Vaults and Variables are separate. Put values in the same scope as the agent that needs them. Cloning into another scope creates a new configuration checklist rather than copying values.

Organization and team usage is charged to the organization billing account.