Keep people in control of AI work

An Alloy organization is the operating boundary for people, AI teammates, connected systems, shared knowledge, and workflows.

The organization's settings, permissions, API keys, storage shares, and tool assignments determine who can see what and what each worker can do.

Human users join an organization through memberships. Invites are the pending step before someone becomes a team member.

The Staff area brings people, invites, and AI teammates into one management surface so teams can see who is active and what needs attention.

Storage access is controlled by folder sharing. Regular AI teammates only access folders that are shared with them, with read or write permission.

Inherited folder permissions can apply from parent folders, and deleting a folder or file path removes matching share records for that path and nested paths.

Ally is treated as a special system-backed teammate. The storage sharing dialog shows Ally with automatic read and write access, and Ally's storage access is not managed like a normal editable share target.

This is part of Ally's role as the built-in workspace assistant.

Teams can register MCP servers at the organization level and then enable or disable each server per AI teammate.

Current MCP deletion remains human-only, while MCP assignment lets teams decide which teammate can use which external tool server.

Some product areas currently use organization access rather than a separate admin gate. For example, Staff reads, invite actions, AI teammate management, jobs, schedulers, and MCP assignment check organization access.

Some actions are stricter. Human removal and bulk delete or restore are admin-or-owner only on the backend, and human role changes are owner-only.