Core concepts

TKP is multi-tenant: every piece of data belongs to exactly one tenant, and access to it is always scoped through that tenant. There are two layers of access control worth understanding before you use the admin panel or connect an agent:

• Tenants & membership roles: who belongs to a workspace, and with how much say over it. This is about people signed in through the browser.
• Permissions & abilities: what a specific credential (an API key or a connected OAuth app) is allowed to do. This is about machines: agents, scripts, and integrations acting on your behalf.

The two layers are independent. A tenant Owner has full say over the workspace in the browser, but any Personal Access Token or Connected App they create still only gets the abilities explicitly granted to it. Being an Owner does not make your agent's token all-powerful by default.