Sign in once and see only the screens your role allows, and AI Crew never goes beyond that
Members use every service with the same organization and permissions after one sign-in. Admins decide which services each role can use and make exceptions only for the people who need them. AI Crew acts only within the permissions of the person who handed off the work, and what it does is kept as an activity record.
Designed for: For IT and security staff reviewing the account and permission setup and how records are kept.
How permissions are set
One sign-in
Sign in once to use every service, such as Mail, Messenger and Approval, with the same organization and permissions. You don't create a separate account for each service.
- SaaS: crewai.work account or sign in with Google
- On-premises: integration with your company accounts (SSO)
Screens that match your role
Members see only the services and screens their role allows.
Role × service permission table
In the admin console, set in a table which services each role can use. You can also make exceptions for specific people.
- Service access by role
- Individual exceptions
Managing members, invites and roles
Invite members and set their roles in the admin console.
Face ID on your phone
Unlock the iPhone app with Face ID.
- The iPhone app is in internal testing
Permissions of people and AI Crew compared
| Item | People | AI Crew |
|---|---|---|
| Where permissions come from | The role set by an admin, plus individual exceptions | The permissions of the person who handed off the work |
| What it can see | Services and files allowed for the role | Only within what the person who handed off the work can see |
| Sending and sharing outside | Directly, according to permissions | Only after a person checks |
| Approvals and payments | Directly, according to permissions | Cannot (review comments only) |
| Account and security changes | With admin permissions | Cannot (blocked by the system) |
Activity records
Who handed off what, and who approved it, is recorded.
What AI Crew does is kept as an activity record. You can check later who handed off the work, who approved the confirmation card and what the result was.
On AgentHub's connections, controls and activity records screen, you see the connected tools and activity for each AI Crew. A dedicated store that keeps records for audits separately is in preparation.
What admins should check
- Define roles and fill in the role × service permission table
- Make individual exceptions only for people who need them
- Set the organization's time zone (it is passed on to AI Crew too)
- Check that each AI Crew has a responsible person
- Make human check stages stricter if needed
- Regularly review AI Crew activity on the activity records screen
Frequently asked questions
Can we give AI Crew admin permissions?
AI Crew's permissions never go beyond those of the person who handed off the work. Even if an admin hands off the work, account and security changes are blocked by the system.
What about people who belong to several companies?
Roles and permissions apply separately for each company, and data and AI Crew's memory are also kept separate for each company.
Can it integrate with our company account system?
With SaaS, you sign in with a crewai.work account or a Google account. On-premises integrates with your company account system (SSO), and the details are set in consultation.
Can we keep records separately for audits?
For now, you check activity records and AgentHub activity records. A dedicated store that keeps records for audits separately is in preparation, and the retention period and method are explained in a sales consultation.
Related pages
Start with AI Crew in the November closed beta.