Authorization

Whether you may do something is answered in layers, and each layer is narrower than the one before it.

Description

How a table is exposed. Each table is for its owner, is a public catalog, or is for admins, and the generated API serves it accordingly.
Workspace roles. What you may create, read, update, delete or manage in each feature area, combined from your roles. If you cannot read an area, it does not exist for you. The Teams pages cover roles.
Grants. Permission on a bucket, a bucket type or a row, checked with the layer above it as the ceiling.
Agent control. For a persona acting on your behalf: whether it may act at all, the overlap of its grants with yours, a hard floor it can never go below, and a queue where its consequential actions wait for your approval.

Tech Detail