Granular access control for your team. Assign roles, control access to folders, features, and connections per person. Everyone gets exactly the access they need, nothing more.

Control access at every level.

Folder and space permissions.
Control who can access each folder and space in your workspace. A client project folder is visible only to the team working on it. Internal strategy documents are limited to leadership. Each space has its own access settings, independent of the rest of the workspace.

Role-based access.
Define roles that bundle permissions together. A "viewer" can read but not edit. A "contributor" can create and edit content but not delete or share externally. An "admin" can manage permissions and workspace settings. Assign roles to team members and their access is configured in one step.

Direct grants.
For situations where roles are too broad, grant permissions directly to a specific person. Give one team member access to a particular folder without changing their role or affecting anyone else. Direct grants and role-based access work together.

Capabilities, not just content.

Feature-level controls.
Control which features each role or person can use. Restrict who can publish content externally, who can create background agents, who can invite external agents, or who can enable link analytics. Access control covers capabilities as well as content.

Connection-level controls.
Control who can access each connected app. A team member with access to the Gmail connection can search company email. A team member without that connection cannot. Each integration is a separate permission.

Sharing controls.
Define who can share content externally, who can add password protection, and who can generate tracked links. Prevent accidental external sharing by restricting these capabilities to the roles that need them.

The Principle of Least Privilege, applied.

Most workspace tools start with broad access and expect administrators to lock things down. Everyone can see everything by default, and restricting access is an afterthought that requires manual configuration for every folder, every feature, and every new team member. The result is that most teams either leave everything open because configuring restrictions is too much work, or lock things down so aggressively that people cannot find what they need.

Fabric follows the Principle of Least Privilege. Each team member gets exactly the access they need for their role, and no more. This is not about being restrictive. It is about being deliberate. A designer needs access to design assets, brand guidelines, and client feedback. They probably do not need access to financial projections, HR documents, or the sales pipeline. A junior team member needs access to their project folders. They probably do not need the ability to publish content externally or invite external agents to the workspace.

The benefit is not just security. It is clarity. When people see only the content relevant to their work, the workspace is easier to navigate. Search results are more relevant because they do not include content from other teams. Smart organization works better because the content landscape is scoped to what matters. The workspace feels personal even though it is shared.

Roles make scale manageable.

Managing permissions per person works for a team of five. It does not work for a team of fifty. Roles solve this by bundling permissions into reusable templates. Define what a "project lead" can do once, and every person assigned that role gets the same access. When the role definition changes, everyone with that role is updated automatically.

This is especially important for growing teams where new people join regularly. Instead of manually configuring permissions for every new hire, you assign them a role and their access is set. When someone moves to a different team or takes on new responsibilities, you change their role and their permissions update accordingly. The onboarding process becomes faster because access is part of the role, not a separate configuration task.

One model for humans and agents.

The same access control philosophy that governs human team members extends to external AI agents through Agent Vault and Agent Passes. An external agent invited to your workspace gets a role with defined permissions, just like a human team member. It can access the content you grant, use the capabilities you allow, and interact with the connected apps you authorise. The access control model is consistent regardless of whether the team member is human or AI.

This consistency matters because it means administrators learn one model and apply it everywhere. The same concepts of roles, permissions, time-limited access, and audit logging work the same way for people, for Fabric's native background agents, and for external agents. As your team adopts more AI tools, the governance model scales without adding complexity.

Complete visibility and audit.

Every permission grant, role assignment, and access change is logged. Administrators can see who has access to what, when permissions were changed, and who made the change. When combined with the audit trails from Agent Vault and Agent Passes, you get a complete picture of access across your entire workspace, both human and AI.

Activity logging covers content access as well as permission changes. If compliance or internal policy requires demonstrating who accessed specific content and when, the logs provide that evidence. For law firms, consultancies, and any organisation handling sensitive data, this audit capability is a requirement, not a nice-to-have.

Use cases

Client isolation
Agencies and consultancies managing multiple clients need to ensure that team members on one account cannot see another client's materials. Folder-level permissions enforce this cleanly. Each client project is accessible only to the people assigned to it. See how Fabric supports client work.

Departmental access
Engineering sees engineering docs. Sales sees the sales knowledge base. Leadership sees everything. Each department gets access to the content relevant to their function without being overwhelmed by content from other teams. See how Fabric supports team wikis.

Contractor and freelancer access
External freelancers and contractors need access to specific project materials without seeing the rest of your workspace. Assign them a restricted role with access to their project folder only, and revoke it when the engagement ends.

New hire onboarding
Assign a role during onboarding and the new hire's access is configured automatically. They see the content relevant to their role from day one, without an administrator manually configuring dozens of folder permissions.

Sensitive content governance
Financial documents, legal materials, HR records, and strategic plans are restricted to the people who need them. Feature-level controls prevent accidental sharing or publishing of sensitive content. See how Fabric supports data rooms.

Perfect for

Startups scaling their team
Access control that grows with you. Start simple with a few roles and add granularity as the team gets larger. New hires get the right access from day one without manual configuration. Learn more about Fabric for startups.

Agencies
Client isolation, contractor access, and multi-team coordination all managed through roles and permissions. Every person sees the content they need and nothing else. Learn more about Fabric for agencies.

Law firms
Case file access restricted to assigned team members. Sharing controls that prevent accidental external distribution. Audit logging that demonstrates compliance with confidentiality requirements. Learn more about Fabric for law firms.

Research teams
Control access to unpublished research, sensitive data, and collaborative materials. Different roles for principal investigators, researchers, and research assistants with appropriate access levels for each. Learn more about Fabric for research teams.

Works seamlessly with other features.

Agent Vault
The same access control model extends to external AI agents. Agents are treated as non-human team members with roles, permissions, and audit trails that match the human model.

Agent Passes
External agents that interact with your connected apps are governed through Agent Passes, extending the Principle of Least Privilege to every AI interaction with external services.

Collaboration
Roles and permissions integrate with Fabric's real-time collaboration features. Permission levels determine whether a team member can view, comment, edit, or administer shared content.

Private and secure
Roles and permissions are one layer of Fabric's privacy and security model, alongside encryption, password protection, and access logging.

FAQ

What roles are available?
Fabric provides default roles including viewer, contributor, editor, and admin. You can also create custom roles that bundle exactly the permissions your organisation needs. Each role can be configured for content access, feature capabilities, and connection access.

Can I create custom roles?
Yes. Define roles that match your organisation's structure and needs. A "project lead" role, a "client viewer" role, a "contractor" role, or anything else that makes sense for how your team works.

Can I grant access directly to a person without using a role?
Yes. Direct grants let you give a specific person access to a specific folder, feature, or connection without changing their role. This is useful for one-off exceptions and temporary access needs.

Can I restrict which features a role can use?
Yes. Feature-level controls let you restrict capabilities like publishing, external sharing, agent creation, and external agent invitation to specific roles. Not everyone needs every capability.

Can I restrict which connections a role can access?
Yes. Each connected app can be restricted to specific roles. A team member without the Gmail connection permission cannot search company email through Fabric.

How does this work when someone joins the team?
Assign them a role during onboarding and their access is configured automatically. They see the folders, features, and connections appropriate for their role from day one.

What happens when someone changes roles?
Change their role assignment and their permissions update automatically. They gain access to the content and capabilities of their new role and lose access to anything their new role does not include.

Can I see who has access to what?
Yes. A centralised view shows every team member, their role, and their specific permissions. You can audit access across the entire workspace at any time.

Is there an activity log?
Yes. Every permission change, role assignment, and content access is logged. Administrators can review who accessed what content, when permissions were granted or revoked, and who made each change.

Does the same model apply to AI agents?
Yes. External agents are treated as non-human team members with the same role and permission model. Agent Vault governs their workspace access, and Agent Passes governs their connected app access. The Principle of Least Privilege applies consistently across humans and agents.

Is this available on all plans?
Basic sharing permissions are available on all plans. Role-based access control, custom roles, and advanced team governance are available on Team plans. See team pricing for details.