Access and permissions

Cortex authorizes every operation within one Socra Account and applies the permissions of the authenticated principal.

Account boundary

A Socra Account is the customer-owned organizational and authorization boundary. A person can belong to more than one Account, but Cortex resources and operations do not cross Account boundaries.

The Account selected during OAuth determines which Cortex data the integration can access. Changing the active Account in one client does not silently change another client's stored grant.

Principals

A normal OAuth connection acts as the signed-in Account member. An Account Agent is a distinct principal and is used only when your organization creates and connects one explicitly.

Do not describe a human OAuth grant as an Agent identity. The two principals have different provenance even when they participate in the same work.

Module access

Modules are public within the Account by default and can be private by exception. Module-level grants are the intended authorization boundary, but the complete granular grant layer is not yet available on every Cortex surface.

Until a documented surface exposes a specific grant operation, do not assume that creating a private Module provides a fully configurable role system.

Cloud Projects

The first-party coding-agent integration uses OAuth clients owned by Socra's agent-plugins Cloud Project. The customer authorizes a Socra Account and does not create a Cloud Project for this path.

Custom applications remain Project-owned integrations. Follow the custom MCP guide when your application needs its own OAuth client, attribution, and service-consumption boundary.