Identity and access
Each CoAgent has its own principal in the Account directory. The Socra CLI in its computer authenticates as that principal. Actions taken with that identity are subject to its permissions, rather than inheriting the creator's access.
Managing a CoAgent versus working with it
Account owners and admins currently manage CoAgent resources, including configuration, credentials, and lifecycle. Per-CoAgent management roles are not currently exposed.
Working with a CoAgent in Channels or Cortex follows those apps' permissions. Access to a conversation does not grant authority to change the CoAgent's model or credentials.
Resource access
Give the principal access to each resource needed for its responsibility: for example, a Cortex module, a Channels conversation, or a Cloud Project.
Instructions do not grant permissions. Naming a repository in a message or editing the CoAgent's identity file does not authorize access to it.
External services
A Socra identity is not automatically an account on GitHub or another external service. External actions use the credentials or integration supplied for that service, and may be attributed to that external identity.