People and roles
Everyone on your team signs in with their own identity. An Admin adds them in Agent › People and gives each one a role. Never share an identity or a wallet.
| Role | For | Can |
|---|---|---|
| Read-only | Anyone who follows the fleet | See canisters, metrics, dashboards, alerts and history. |
| Read-write | Operators | Everything above, plus run operations, edit the canister list and dashboards, and ask the AI assistant. |
| Admin | Owners and trusted leads | Everything above, plus People, Monitor, top-up limits, storage and controller changes. |
The owner is always an Admin and can’t be removed. Operations and permissions lists exactly what each role allows.
Add a teammate
Section titled “Add a teammate”-
Ask your teammate for their principal: it’s in their icLens Settings › Account and wallet. Confirm it over a channel you trust.
-
Choose Add member, paste the principal, add a display name, and pick a role.
-
Confirm with Apply as You.
-
Send them the Agent’s canister ID. They choose Connect an Agent and sign in with that identity.
Change or remove access
Section titled “Change or remove access”Use Edit member to change a role, or set the member Inactive to pause their access and keep their history. Remove member deletes the membership; their past actions stay attributed to them in Activity.
Good to know
Section titled “Good to know”- A role lets someone ask the Agent to act. The Agent also needs access to the canister: Read-write can stop a canister only if the Agent controls it.
- Roles apply to the whole Agent. For separate environments, use separate Agents.
- If Viewer access is on, anyone signed in can still read, including removed members. Share read-only access.
- Every change is recorded in Activity and audit.