Some material should only reach a few people: personnel files, a legal matter,
board papers. GBrain keeps that material apart by giving the team a separate
workspace in a separate organization, with only that team in it.

There are no per-folder permissions. Inside a workspace, and across every
workspace in one organization, every member can read the memory and the chats.
That is what lets a team share one memory without thinking about it, and it is
why the wall goes around the organization, not around a folder.

## The organization is the wall

Who can open a workspace in GBrain is decided by who is a member of its
organization. A few other ways in are listed below, under Other ways in.

- **Every member of an organization can read every workspace in it.** A second
  workspace in the company's organization does not keep the rest of the company
  out.
- **A separate organization does.** Someone who is not a member of it cannot
  open its workspace, its chats or its memory in GBrain, and cannot tell it
  exists.
- **Admins are members too.** They also change its settings and decide who is
  in it.

So a sensitive team gets its own organization, and only the team joins it.

## Set it up

1. **Make a new organization.** From your account, open Organizations and
   choose New organization. Name it for the team, for example "Acme HR". You
   are its first admin.
2. **Add a workspace to it.** Start the workspace from inside the new
   organization, so it is billed to and reached through that organization.
3. **Invite only the team.** In the organization's Members, add each person by
   email. An invitation works only for the address it was sent to. Skip invite
   links, or keep one that asks an admin before anyone joins: a link set to let
   in everyone at a company's email domain lets the whole company in.
4. **Leave chat apps off.** Do not connect Slack or Telegram to it unless
   everyone those apps let message it belongs on the team.
5. **Check who can read it.** Open the workspace's Settings, then Data
   protection. It lists each group that can read the workspace, with how many
   people are in each, and the chat apps connected to it.

Someone who leaves the team is removed from the organization's Members, and
their access ends there.

## Who can read it

The workspace's Data protection page names each group, from the same records
that let people in:

- **Members and admins** of its organization: its memory and its chats.
- **An expert** an owner brought in to set it up. Experts are admins, so they
  are counted with the admins, and admins see them by name.
- **Guests**, only if the workspace has guest chats. A guest reads only through
  their own guest chat and changes nothing, and a guest chat can be set to not
  read the memory at all.
- **GBrain staff**, when they add themselves as an admin to support the
  workspace. Each time is recorded, and while they are in they show on the
  page like any other admin.

## Other ways in

- **Chat apps.** A workspace connected to Slack or Telegram answers whoever
  those apps let message it, and it can tell them anything it knows, whether
  or not they are members. Each app's page in the workspace's Messaging says
  who that is.
- **Guests.** A workspace with guest chats lets each guest in through their own
  link, as described above.
- **A guest's own conversation** is the one thing members do not all read:
  only that guest and the workspace's admins can.

## Bring material in by copying it

The team's workspace starts empty, and nothing flows into it from the company's
other workspaces. Material moves only when someone copies it:

- **Add the documents themselves**, in the team's workspace chat or its
  memory. See [Memory](/docs/workspace/memory).
- **Start from a snapshot.** If the team needs what another workspace already
  knows, [fork that workspace](/docs/workspace/share-a-copy) into the team's
  organization. The fork is a copy taken once; the original is not linked to it
  afterwards.

Nothing in the sensitive workspace flows back out either, unless a member of it
copies it somewhere.

## Coming next

**A record of staff access.** Each time someone at GBrain, or GBrain's
support AI, opens the workspace, it is recorded first, with who, what and why.
The organization's admins read it on the workspace's Data protection page.

These are being built for workspaces like this one. Each is not available yet,
and this page will say how to turn it on when it is:

- **Approved models only.** Limit the workspace to the AI providers and model
  endpoints an admin approves, for example ones that process data in the EU.
- **Owner approval for colleagues' accounts.** A teammate's connected account,
  such as their email, is used by the workspace only once that person approves.

## What it does not do

- Hide one folder or one workspace chat from someone who is a member.
- Keep a second workspace in the same organization private from that
  organization's members.
- Copy anything between organizations on its own.