[Docs index](/docs.md) / [Workspace Permissions](/docs/workspace-permissions/overview.md) / Using the Permissions Simulator

---

# Using the Permissions Simulator

The simulator answers one question: "Does user X have permission Y on resource Z?" Use it to verify that a permission grant worked, diagnose why someone can or cannot access a resource, and test before making changes.

## Before you begin

- You must be a workspace admin to use the simulator.

## Steps

### 1. Open the simulator

Go to **Workspace > Permissions** and select the **Simulator** tab.

### 2. Select a user

Pick the user you want to test from the dropdown.

### 3. Select a resource

Pick the resource type (subagent, sandcastle, tool, etc.) and the specific resource.

### 4. Select a relation

Choose the permission level to test: View, Execute, Edit, or Admin.

### 5. Run the simulation

The simulator returns:

- **Has access: Yes / No** — whether the user has the requested permission level on the resource.
- **Reason** — why access was granted or denied.
- **Source** — how the user got the access: ownership, direct grant, or group membership. If it was a group grant, the simulator names the group.

## When to use the simulator

- **After granting access.** Verify the grant took effect. If the user already had access through a different path, the simulator shows you.
- **When someone reports they can't access something.** Test their user against the resource. The simulator tells you exactly what's missing.
- **Before revoking access.** Check whether the user has access through multiple paths. If they have both a direct grant and a group grant, revoking just the direct grant won't change their effective access.
- **During onboarding.** After adding someone to groups, test a few resources to confirm they see what they should see.

## Related guides

- [Managing users](./managing-users.md)
- [Managing resource permissions](./managing-resource-permissions.md)
- [Overview](./overview.md)
- [Troubleshooting](./troubleshooting.md)

---

## Navigation

### In this section: Workspace Permissions

- [Workspace Permissions](/docs/workspace-permissions/overview.md)
- [Troubleshooting](/docs/workspace-permissions/troubleshooting.md)
- [Managing Groups](/docs/workspace-permissions/managing-groups.md)
- [Managing Resource Permissions](/docs/workspace-permissions/managing-resource-permissions.md)
- [Managing Users](/docs/workspace-permissions/managing-users.md)
- [Setting Up SSO](/docs/workspace-permissions/setting-up-sso.md)
- **Using the Permissions Simulator** (current)

### Other sections

- [MCP Servers](/docs/mcp-servers/overview.md)
- [Tool Creation](/docs/tool-creation/overview.md)
- [Agent Filesystem](/docs/agent-filesystem/overview.md)
- [Chat Sharing](/docs/chat-sharing/overview.md)
- [Scheduled Triggers](/docs/scheduled-triggers/overview.md)
- [Agent Skills](/docs/agent-skills/overview.md)
- [Sandcastles](/docs/sandcastles/overview.md)
- [Subagents](/docs/subagents/overview.md)

[Back to docs index](/docs.md)