Skip to main content
Dust gives you three workspace roles and a set of granular permissions. Together, they control what people can manage, create, publish, and access in your workspace.

​
Roles

​
Admin

Admins have full workspace administration access. They can configure workspace settings, manage members and groups, and control permissions. Admins always retain access to capabilities set to Admin only. By default, Admins can:
  • Manage billing and subscriptions
  • Manage security settings, user access, identity verification, and provisioning
  • Configure all governance permissions, including Access billing features and Access security features
  • Map groups to the Admin or Manager role
  • Enable or disable the policy for sharing Frames externally
  • Enable or disable audit logs

​
Manager

Managers are delegated workspace administrators. They can:
  • Invite and remove members
  • Change the roles of non-admin members
  • Assign the Manager and Member roles
  • View workspace Analytics and the Credits page. Credit-priced plans show credit pools and member/group usage; non-credit-priced plans show programmatic usage and settings.
  • Access the Groups tab and set each group’s limit per member and group budget
  • Appoint and remove group managers
  • Review and act on credit upgrade requests from members
  • Configure governance permissions for agents, skills, Frames, and automations, such as which groups can create and publish agents and skills
Managers do not receive Access billing features or Access security features by default. Admins can grant either permission to groups in Admin > Members, Roles tab, Billing and security section. The Manager role alone does not grant access to Security settings or audit logs. An Admin can delegate Access security features to a group, which gives its members access to the corresponding Security controls. The Manager role also does not let someone change the workspace policy for sharing Frames externally. When that policy is enabled, Managers can configure which groups may invite users to Frames and make them public.

​
Member

Members use Dust according to their seat, group memberships, resource access, and granted permissions. Members do not have administrative access by default. Admins can grant Members additional permissions through groups.

​
Group managers

Workspace Admins and Managers can appoint group managers to manage membership, credit limits, and credit requests for selected groups. This appointment is separate from a person’s workspace role. It lets team leads manage their groups without giving them the workspace Manager role.

​
Groups and permissions

Dust supports two types of groups:
  • Provisioned groups, synchronized from your identity provider through SCIM
  • Manual groups, created and managed in Dust
Permissions are granted to groups rather than directly to individual people. To grant a permission to one person, create a manual group, add that person to it, and grant the permission to the group. Permissions are additive. If a person belongs to several groups, they receive the combined permissions granted by those groups. A group grant adds access and does not remove access granted elsewhere. Each permission uses one of three modes:

​
Managing groups with the workspace management MCP server

Admins and Managers can also manage groups programmatically through the workspace management MCP server, using four tools:
  • list_groups: list workspace groups, optionally filtered by kind
  • get_group_members: list a group’s current members
  • create_group: create a new manual group with an initial member list
  • update_group_members: add or remove members from an existing manual group
These tools only see and manage provisioned (SCIM) and manually-created groups. Internal group kinds used by Dust are not exposed, even to a caller who knows their ID.

​
Permission matrix

Most of the following permissions are managed in Admin > Governance. Access billing features and Access security features are managed in Admin > Members, Roles tab. In a new workspace, Create agents, Publish agents, Invite people by email, and Share by public link are set to Everyone. Create skills, Manage skill availability, Make skills discoverable to agents, and Charge automations to the workspace are Admin only until an Admin or Manager changes them. Access billing features and Access security features can only be granted to groups, by an Admin. Charge automations to the workspace lets people run their triggers on the workspace credit pool instead of their own credits. See Credits usage. Making a skill discoverable to agents, or changing the availability of an already discoverable skill, requires the Make skills discoverable to agents permission (Admin > Governance, Agents & Skills tab). It’s Admin only by default; users without it cannot enable or change auto-discoverability. Granting it without also granting Manage skill availability has no effect: a group needs both to act on it.

​
Workspace governance settings

Workspace governance policies are managed in Admin > Governance. Managers can change the permissions there. Other settings on that page, such as pod and feature settings, are Admin only. Group role mapping and billing/security access are managed in Admin > Members, Roles tab. Access billing features and Access security features are group permissions, not separate workspace roles. Admins receive access by default and can delegate either permission without changing members’ workspace roles. Access security features also grants access to workspace Security and Computer network/environment controls.

​
How access is determined

A person’s effective access combines:
  1. Their workspace role
  2. The permissions granted to their groups
  3. Their access to specific resources, such as spaces, agents, skills, and other workspace content
These sources of access are additive. A permission granted through one group does not remove access granted through another group or through the person’s workspace role.