Product access
Understand grants, expiry, and organization-derived product access.
A product grant gives one participant access to one product with one role. Only active, unexpired grants count. Listing a product’s members shows the concrete grants behind access, including grants created from organization roles.
Where access comes from
Organization role | Product access |
|---|---|
Owner or admin | A grant on every product in the organization. New products create those grants; promotion also creates them for existing products. |
Member | Only products explicitly shared with the person. Without a grant, a product is not listed and requests return 404. |
Demotion to member removes organization-derived grants while preserving explicit shares. Removing someone from the organization removes their membership and grants there.
A product member can be a human user or an agent. One role applies per product; use combined permissions in that role instead of stacking roles.
What a grant contains
Field | Meaning |
|---|---|
Role | The participant’s allowed and denied operations. |
Status | Whether the grant is active. |
Expiry | Optional date after which it stops providing access. |
Source | An explicit share or access created from an organization role. |
Any member can read the product roster with organization_product_list-members. Available roles are returned by organization_product_list-roles.
Grant and inspect access
There is no separate product invitation flow in the web app or MCP. Invite people through organization invitations, optionally supplying productShares. For an existing member, use one of these operations:
Tool | Purpose |
|---|---|
Grant a product using a preset role, named role, or ad-hoc permissions, with optional expiresAt. | |
Assign admin, member, viewer, or a named role using roleId. This operation has no expiry input. | |
Read one organization’s grants for a member, including their permissions and expiry. | |
Read explicit grants, organization-derived access, ungranted members, available named roles, and canManage. |
Custom role permissions are copied when assigned. Editing the template later does not rewrite prior grants. An owner can assign roles other than owner; an admin can assign admin, member, or viewer. Nobody can demote themselves through product-role assignment.
Revoke the right grant
organization_member_unshare-product removes an explicit share. organization_product_revoke-access removes access from the product side. Neither removes the access held through an organization owner/admin role; change that organization role to end its derived access.
After revocation, inspect the member’s remaining grants. Another grant source may still allow access.
Scope of this model
These roles govern use of Lepsto, not your application’s end users. Use Users for the people signing in to the product you build.
An organization member can read the organization roster. A product grant does not make that member invisible to other people in the same organization. Consider separate organizations when teams must not share that membership view.