Who sees what
Every agent signs in as a teammate and sees exactly what that teammate can see, nothing more. These rules apply the same way in the web app, over OAuth, and with API keys.
Email stays private
Section titled “Email stays private”Raw email stays private to its owner. The team gets only the facts drawn from it, never the message itself.
Meetings
Section titled “Meetings”You see meetings you attended or that were shared with you. Transcripts are readable by the recording owner, attendees, and people it was shared with.
Scopes
Section titled “Scopes”Admins create scopes like HR, Board or Legal by describing them in plain words. Nysa sorts each fact into the right scope, so one email can be split between the team and a restricted scope. Only members of a scope see its facts.
Private projects
Section titled “Private projects”Group a project’s meetings, email and facts in one place. Projects start private to their members.
Personal
Section titled “Personal”Everyone has a personal scope no one else can read, including admins. Private notes and your agent memory live there.
Agents and API keys
Section titled “Agents and API keys”- An agent acting for you can never see more than you can.
- API keys can be read only or read and write, and limited to chosen projects or scopes.
- Restrictions are enforced in the database. Hidden facts leave no trace: an agent can’t tell that something exists if it can’t see it.
- Leave the workspace and the next request is denied. Each call is audited.