Using the Permissions Simulator
The simulator answers one question: "Does user X have permission Y on resource Z?" Use it to verify that a permission grant worked, diagnose why someone can or cannot access a resource, and test before making changes.
Before you begin
- You must be a workspace admin to use the simulator.
Steps
1. Open the simulator
Go to Workspace > Permissions and select the Simulator tab.
2. Select a user
Pick the user you want to test from the dropdown.
3. Select a resource
Pick the resource type (subagent, sandcastle, tool, etc.) and the specific resource.
4. Select a relation
Choose the permission level to test: View, Execute, Edit, or Admin.
5. Run the simulation
The simulator returns:
- Has access: Yes / No — whether the user has the requested permission level on the resource.
- Reason — why access was granted or denied.
- Source — how the user got the access: ownership, direct grant, or group membership. If it was a group grant, the simulator names the group.
When to use the simulator
- After granting access. Verify the grant took effect. If the user already had access through a different path, the simulator shows you.
- When someone reports they can't access something. Test their user against the resource. The simulator tells you exactly what's missing.
- Before revoking access. Check whether the user has access through multiple paths. If they have both a direct grant and a group grant, revoking just the direct grant won't change their effective access.
- During onboarding. After adding someone to groups, test a few resources to confirm they see what they should see.