- Workstream — which client’s boundary the data sits in, and therefore which people/agents scoped to that client can reach it.
- Agent / Space — which agents are allowed to read it.
Doc Store scoping
A Doc Store belongs to a client (workstream) and is granted to specific agents. So “who can read these files” = people on that client + agents explicitly granted. See Setting Doc Store access.Data Store scoping
A Data Store table picks a scope at creation:- Global — every workstream and agent (reference data only).
- Workstream-based — row-level security; each client sees only its rows (the safe default).
- Workstream + Agent — per client, and only tagged agents.
Capability vs access (say it again)
A skill grants capability, not access. Enabling “Read documents” doesn’t reveal any new data; it lets the agent read what it’s already been granted. Widening access is always a deliberate scoping change, never a side effect of turning on a skill.Reasoning checklist
When you’re unsure whether someone or something can reach data, ask in order:- Are they scoped to the client? If not, stop — they see nothing.
- Is the agent granted to the store? If not, the agent can’t read it.
- For a Data Store, does the table scope include this client (and agent)?