Access Control
Define exactly what each member of your team can do inside Sypha — at the organisation and individual level, enforced server-side.
Access Control lets administrators define exactly what each member of a team can do inside Sypha. Permissions are level-based, assigned at the organisation and individual level, and enforced server-side. Permission settings are managed from the Sypha admin backend and flow down to each user automatically.
[!NOTE] Access Control is available on Teams plans.
Permission Layers
Sypha uses a two-layer permission model: organisation-level defaults applied to everyone, with individual overrides on top.
| Layer | What It Controls |
|---|---|
| Organisation-level | Applied to the entire team by the org admin. Covers: Provider & model allow list (restrict which AI providers and models each member can use — anything not on the list is hidden); Browser access; Terminal access; MCP access. |
| Individual-level | Set per user on top of org defaults. Covers: File operations (read_project_files, read_all_files, edit_project_files, edit_all_files); Command execution (execute_safe_commands or execute_all_commands); Auto-approval for reads, writes, deletes, terminal runs, browser actions, MCP calls, subtasks, mode switches, and follow-up questions; Todo list updates. |
Available Permission Flags
| Flag | Description |
|---|---|
| Auto Approval Enabled | Enables the auto-approve menu for the user |
| Allow Read Only | Restricts the user to read-only file access |
| Read Outside Workspace | Allows reading files outside the project directory |
| Allow Write | Permits writing files |
| Write Outside Workspace | Allows writing files outside the project directory |
| Write Protected Files | Permits editing files marked as protected |
| Allow Delete | Permits file deletion |
| Allow Execute | Allows running terminal commands |
| Allow Browser | Enables browser and headless browser access |
| Allow MCP | Allows connecting to and using MCP servers |
| Allow Mode Switch | Permits changing between agent modes |
| Allow Subtasks | Allows Sypha to spawn sub-agent tasks |
| Allow Follow-up Questions | Permits Sypha to ask clarifying questions |
| Allow Todo Updates | Allows Sypha to update the todo list |
| Approve Resubmit | Controls whether the user can resubmit previously rejected actions |
How Enforcement Works
- When a user opens Sypha, the extension fetches their permission profile from the Sypha backend (refreshed every 45 seconds).
- The profile contains their permission flags and the org-level allow list.
- The extension merges org-level settings with individual overrides — organisation settings take precedence where explicitly set.
- All capability checks are fail-closed: if the profile cannot be fetched, access is denied rather than granted.
- Provider and model selectors in the UI automatically hide anything not permitted by the allow list — users only see what they are allowed to use.
Setting Up Access Control
- Navigate to the Dashboard at app.sypha.ai.
- Open the Manage Team tab.
- Select a team member or use Organisation Permission Settings to set defaults for all new members.
- Toggle the permissions you want to grant or restrict.
- Click Save — changes take effect instantly, no restart required.
Organisation-Wide Defaults
Use the Organisation Permission Settings panel to configure defaults that apply automatically to all new members when they join. Individual members can then be given higher or lower permissions on top of this baseline.
Provider and Model Allow List
The allow list lets you restrict which AI providers and models your team can use. This is useful for:
- Cost control — prevent use of expensive models without approval.
- Compliance — ensure all AI traffic goes through approved providers.
- Consistency — standardise the model used across the team.
Any provider or model not on the allow list is hidden from the provider and model selectors in the UI. Users cannot access restricted models even if they know the model name.
Related
- Team Management — invite members, manage seats, and configure roles
- Analytics — monitor usage and costs across your team
- Plans — compare plan tiers and what's included