Permissions and abilities

TKP checks access at three levels: your workspace role, your library membership, and the permissions of the application connecting on your behalf. This lets a team share a workspace without exposing every library to every member or app.

Your access in the panel

Your tenant role controls whether you can manage the workspace. Library membership controls whether you can read or change its content. Even a tenant Owner needs access to a library to read its files.

Creating a library makes you its Admin. To share it, open the library's Members tab and add the people who need access.

Library role	Access
Admin	Can read, upload and delete resources, update the library, and manage library members.
Member	Can perform only the actions explicitly assigned to that membership. These can include reading, uploading resources, updating the library and deleting resources.

For example, a library Member with read permission can search and inspect files but cannot upload new ones unless they also receive permission to create resources.

An application's access

An access token is a secret that your application sends with its requests. An OAuth connection lets an application ask you to authorize it through a browser. TKP lists these under Access Tokens and Connected Apps respectively. Both act on your behalf within one tenant.

When you create or authorize a connection, choose its interfaces and abilities. An interface determines where it may connect:

Interface	Enables
API (api)	REST requests sent directly by application code.
MCP (mcp)	Calls to the tools exposed to MCP clients.

An ability is a permission to perform an action. For example, Read lets the application search and inspect content. Create resources lets it upload files. You can grant abilities for specific libraries or grant workspace-wide abilities that also cover libraries created later. Creating and deleting libraries have separate workspace-wide abilities.

The application's permissions cannot exceed your own access. Giving a token Read for a library you cannot read will not make that library accessible. Likewise, a token does not inherit every permission you hold: choose its permissions explicitly when setting it up.

Choose permissions for an integration

Start with the API or MCP interface the application uses and read access to one library. Add Create resources only if it must upload files. This keeps an accidental or unwanted action in that application from changing other content.

Follow access token setup for a script, or OAuth setup for an application that supports browser authorization.