Team access control

By default every organization member can edit any catalog entity and see every interface. Team access control reserves two things for the team that owns an entity:

Control	When it is on
Limit editing to the owning team	Only the team’s members and organization admins can add entities for the team or edit the ones it owns.
Limit private interfaces to the owning team	Interfaces with Private visibility are shown only to the team’s members and organization admins.

The two controls are independent — switch on either, both, or neither. Both are off until an admin turns them on.

Organization admins are never restricted: they can edit every entity and see every interface whatever the settings say.

Set the organization default

Open Organization settings → Team Access. Each control has its own switch, and a change applies immediately to every team that has not overridden it.

Override a team

A team can differ from the organization. Open the team, choose Edit Team, and under Access control set each control to one of:

Organization default — follow the organization’s switch.
Team members only — on for this team, even when the organization’s switch is off.
Any organization member — off for this team, even when the organization’s switch is on.

Only admins can set an override. Overrides are available on synced teams too: the external system manages the team’s name and members, and Componecat manages its access control.

The team’s page shows which controls are in effect for it.

What “editing” covers

When editing is limited, a member who is not on the owning team can still read the entity but cannot:

create an entity owned by that team, or hand an existing entity over to it;
change the entity’s details or fields, move it to Trash, or refresh its repository metadata;
add, change, or remove its interfaces, documentation sections and links, activity log entries, or the relationships it declares.

Moving an entity to a different team needs edit access for both the current owner and the new one. Moving a team’s entities in bulk, with Move to team on the team’s page, is for organization admins only.

Changes that arrive from a repository — a componecat.yaml descriptor, repository scanning, documentation sync — are not edits by a person and keep working as before.

What “private interfaces” covers

When private interfaces are limited, a member who is not on the owning team does not get them anywhere: not on the entity’s Interfaces tab, in its descriptor YAML, through the APIs or AI agents, nor by searching — an interface:, interfaceVisibility:, protocol:, or hasSpec: filter only matches interfaces the person searching can see.

Interfaces with any other visibility are unaffected.

Scorecards are evaluated for the organization as a whole, so a rule that counts interfaces counts private ones too, whoever is looking at the result. A result’s evidence, though, lists a private interface only to people who may see it, and a result’s one-line explanation never names an interface.

Who counts as a team member

A member is someone on the team’s roster with a Componecat account. People listed on a roster without an account — common on synced teams — are shown for ownership and contact, but gain no access until they sign in and are linked.

Access tokens and AI agents act as the person who created them, so they follow that person’s team memberships. A service account is not on any team: it is restricted like a non-member unless it has the admin role.

Team sync — keep team membership in step with your identity provider, so access follows it.
Interfaces