How does VibeControls control who on my team can access which machines?

VibeControls[1] controls machine and agent access through a combination of workspace-level role-based access control (RBAC), per-resource ownership, and scoped visibility.

As detailed in Fine-grained RBAC without complexity[2], access is governed by distinct workspace roles:

• Owners & Admins: Have full administrative control over all workspace machines, targets, and agents, with operations recorded in the audit log.
• Members: Can create and manage the machines, agents, and sessions they own. They cannot access or run commands on another member's machines unless those resources are explicitly shared.
• Viewers & Guests: Viewers receive read-only visibility across connected targets and sessions without execution permissions, while Guests get a narrowed, scoped view for external collaboration.

Access is also scoped per resource: machines, agents, and linked entities can remain Private to the creator or be set as Shared with a specific vibe or project workspace. Permissions are re-evaluated on every gateway check, immediately revoking access when a member's role changes or when they are removed.

Teams can manage connected machines, check reachability, and trace personal versus shared machines across the network on the Targets and Agent Mesh Topology concept[3] page.

Concept illustration(opens in a new tab) Illustration of the concept, not a screenshot of the actual product — Targets and Agent Mesh Topology[3]

To see step-by-step instructions on assigning roles, visit the RBAC use-case guide[2] or explore core VibeControls features[4].