From 578711fd5285e0bcd4d6466ae62050cb12c5f648 Mon Sep 17 00:00:00 2001 From: yvjnlee Date: Tue, 27 Oct 2026 18:37:28 -0400 Subject: [PATCH 1/8] docs: prepare factory permissions launch guide Document role capabilities, defaults, inherited admin access, and assignment workflows. Keep publication gated on the planned release. Co-Authored-By: Warp --- .../factories/infrastructure-and-security.mdx | 14 +--- src/content/docs/factories/permissions.mdx | 80 +++++++++++++++++++ src/sidebar.ts | 1 + 3 files changed, 82 insertions(+), 13 deletions(-) create mode 100644 src/content/docs/factories/permissions.mdx diff --git a/src/content/docs/factories/infrastructure-and-security.mdx b/src/content/docs/factories/infrastructure-and-security.mdx index d9d4903a0..4e0aaa1f7 100644 --- a/src/content/docs/factories/infrastructure-and-security.mdx +++ b/src/content/docs/factories/infrastructure-and-security.mdx @@ -100,19 +100,7 @@ Scope each credential to the resources and actions its agent needs. Warp redacts ## Factory roles and permissions -Factory creation uses the team-level Warp Factories role. Team and workspace admins and team-level Editors can create factories. - -Three roles govern an existing factory: - -| Role | Permissions | -| --- | --- | -| User | View and run the factory. Propose definition changes. | -| Editor | Edit the definition and configure agents, repositories, and automations. Attach existing integrations, secrets, and MCP servers. Select existing runners. | -| Admin | Manage members. Delete the factory. Force-merge blocked definition changes. | - -Team and workspace admins and owners always have the Admin role. Factory admins manage roles within their factory. Team and workspace admins manage the team-level Warp Factories role. - -Managing shared runners and connecting team-wide integrations and providers require separate team or workspace permissions. +Factory roles control who can run and configure a factory. User and Editor roles are assignable; Admin access comes from team or workspace administration. See [Managing factory permissions](/factories/permissions/) for capabilities, defaults, and per-factory overrides. Factory roles don't control specification or pull request review. For factory definition changes, treat the files as operational code and protect merges through repository settings. diff --git a/src/content/docs/factories/permissions.mdx b/src/content/docs/factories/permissions.mdx new file mode 100644 index 000000000..a2708373d --- /dev/null +++ b/src/content/docs/factories/permissions.mdx @@ -0,0 +1,80 @@ +--- +title: Managing factory permissions +description: >- + Control who can run and configure Warp Factories with User and Editor roles, team defaults, and per-factory overrides. +--- +import { VARS } from '@data/vars'; + +Factory permissions control what people can do in a factory. Give teammates the User role, shown as **Factory user** in role controls, to run work without changing the configuration. Give them Editor to configure agents, repositories, and automations. + +Role management requires an Enterprise plan. On other plans, team members have Editor access. Team and workspace admins and owners have Admin access. + +## Roles and capabilities + +Editor includes the User capabilities. Admin includes the Editor capabilities. + +| Action | User | Editor | Admin | +| --- | --- | --- | --- | +| View the factory and run work | Yes | Yes | Yes | +| Edit the factory's name, handle, and definition | No | Yes | Yes | +| Configure agents, repositories, and automations | No | Yes | Yes | +| Attach existing secrets, MCP servers, and integrations | No | Yes | Yes | +| Manage factory roles | No | No | Yes | +| Delete the factory | No | No | Yes | + +Admin access comes from your [team or workspace role](https://docs.warp.dev/enterprise/team-management/roles-and-permissions/). You cannot assign Admin through a factory role dropdown or reduce an admin's access with a User override. + +Attaching an existing resource is different from managing the shared resource. Connecting team-wide integrations and managing shared runners require separate team or workspace permissions. + +## How roles apply + +A person's team-level Warp Factories role applies across the team's factories. A per-factory override changes their role for one factory. + +For example, give a teammate User access across the team, then Editor access to the payments factory they maintain. They can configure payments without changing other factories. + +For a non-admin Enterprise team member, Warp resolves the role in this order: + +| Priority | Role source | +| --- | --- | +| 1 | The person's override for this factory | +| 2 | The person's team-level Warp Factories role | +| 3 | The applicable workspace or team default | +| 4 | Editor, if no role or default is set | + +The workspace default takes precedence over the team default when the workspace sets one. A default applies to new and existing members who have no assigned role. Changing a default does not replace a person's explicit team role or per-factory override. + +Factory creation uses the team-level role, not a per-factory override. Team-level Editors and team or workspace admins can create factories. Editor access to one existing factory does not grant factory creation. + +## Changing a team-level role + +You must be a team or workspace admin to assign User and Editor roles. + +1. In the {VARS.FACTORY_WEB_APP}, open a factory and click **Settings** > **Access**. +2. Click **Manage team access**. +3. In the teammate's row, click their current seat type. +4. Choose **Factory user** or **Editor**, then click **Save**. + +The role applies across the team's factories, except where the teammate has a per-factory override. + +## Changing a role for one factory + +As a team or workspace admin, give a teammate a different role in one factory: + +1. In the web app, open that factory and click **Settings** > **Access**. +2. Find the teammate by name or email. In their role dropdown, choose **Factory user** or **Editor**. +3. Click **Save changes**. + +The new role applies only to this factory. It does not change the teammate's team-level role or their access to other factories. + +## Factory permissions and external access + +Factory roles govern who runs and configures the factory. They do not grant access to additional repositories or services. Each run uses the factory's configured [repository identity](/factories/factory-as-code/#credentialstrategy), [secrets](/factories/secrets/), and [MCP servers](/factories/factory-as-code/). + +Specification approval follows the foreman's instructions. Your repository's permissions and branch protection control who can approve and merge pull requests. See [Human decision points and permissions](/factories/factory-agents/#human-decision-points-and-permissions). + +## Related pages + +* [About factory infrastructure and security](/factories/infrastructure-and-security/) +* [Definitions as code](/factories/factory-as-code/) +* [Roles and permissions](https://docs.warp.dev/enterprise/team-management/roles-and-permissions/) - Manage team roles +* [Workspaces for Enterprise teams](https://docs.warp.dev/enterprise/team-management/workspaces/) - Manage workspace roles diff --git a/src/sidebar.ts b/src/sidebar.ts index 539e2216b..0c6299cd5 100644 --- a/src/sidebar.ts +++ b/src/sidebar.ts @@ -424,6 +424,7 @@ export const sidebarTopics: StarlightSidebarTopicsUserConfig = [ // agents and Factory skills, not just a filters reference. { slug: 'factories/automations', label: 'Factory automations' }, { slug: 'factories/factory-as-code', label: 'Definitions as code' }, + { slug: 'factories/permissions', label: 'Managing factory permissions' }, { label: 'Infrastructure', items: [ From 896be521b89060a5ea1d331bb05d7f2b47a4f8eb Mon Sep 17 00:00:00 2001 From: yvjnlee Date: Tue, 27 Oct 2026 18:55:45 -0400 Subject: [PATCH 2/8] docs: tighten factory permissions prose Match the surrounding documentation and remove the semicolon from the roles summary. Co-Authored-By: Warp --- .../factories/infrastructure-and-security.mdx | 2 +- src/content/docs/factories/permissions.mdx | 27 +++++++++---------- 2 files changed, 14 insertions(+), 15 deletions(-) diff --git a/src/content/docs/factories/infrastructure-and-security.mdx b/src/content/docs/factories/infrastructure-and-security.mdx index 4e0aaa1f7..1172d4959 100644 --- a/src/content/docs/factories/infrastructure-and-security.mdx +++ b/src/content/docs/factories/infrastructure-and-security.mdx @@ -100,7 +100,7 @@ Scope each credential to the resources and actions its agent needs. Warp redacts ## Factory roles and permissions -Factory roles control who can run and configure a factory. User and Editor roles are assignable; Admin access comes from team or workspace administration. See [Managing factory permissions](/factories/permissions/) for capabilities, defaults, and per-factory overrides. +Assign User or Editor access to control who runs and configures a factory. Team and workspace admins inherit Admin access. See [Managing factory permissions](/factories/permissions/) for role details and assignment steps. Factory roles don't control specification or pull request review. For factory definition changes, treat the files as operational code and protect merges through repository settings. diff --git a/src/content/docs/factories/permissions.mdx b/src/content/docs/factories/permissions.mdx index a2708373d..11d124d5e 100644 --- a/src/content/docs/factories/permissions.mdx +++ b/src/content/docs/factories/permissions.mdx @@ -5,13 +5,12 @@ description: >- --- import { VARS } from '@data/vars'; -Factory permissions control what people can do in a factory. Give teammates the User role, shown as **Factory user** in role controls, to run work without changing the configuration. Give them Editor to configure agents, repositories, and automations. +Give teammates User access to run work without changing the factory, or Editor access to configure its agents, repositories, and automations. The User role appears as **Factory user** in dropdowns. -Role management requires an Enterprise plan. On other plans, team members have Editor access. Team and workspace admins and owners have Admin access. +Role management requires an Enterprise plan. On other plans, team members have Editor access. ## Roles and capabilities -Editor includes the User capabilities. Admin includes the Editor capabilities. | Action | User | Editor | Admin | | --- | --- | --- | --- | @@ -22,17 +21,17 @@ Editor includes the User capabilities. Admin includes the Editor capabilities. | Manage factory roles | No | No | Yes | | Delete the factory | No | No | Yes | -Admin access comes from your [team or workspace role](https://docs.warp.dev/enterprise/team-management/roles-and-permissions/). You cannot assign Admin through a factory role dropdown or reduce an admin's access with a User override. +Team and workspace admins and owners inherit Admin access from their [team or workspace role](https://docs.warp.dev/enterprise/team-management/roles-and-permissions/). You can't assign Admin in a factory's role settings or reduce an admin's access with a User override. -Attaching an existing resource is different from managing the shared resource. Connecting team-wide integrations and managing shared runners require separate team or workspace permissions. +Editors can attach resources already connected to the team. Connecting team-wide integrations and managing shared runners require separate team or workspace permissions. ## How roles apply -A person's team-level Warp Factories role applies across the team's factories. A per-factory override changes their role for one factory. +A team-level role applies across the team's factories. Override that role for one factory to give a teammate different access there. -For example, give a teammate User access across the team, then Editor access to the payments factory they maintain. They can configure payments without changing other factories. +For example, a teammate with User access across the team can have Editor access to the payments factory they maintain. -For a non-admin Enterprise team member, Warp resolves the role in this order: +For Enterprise team members who aren't admins, Warp uses the first role set in this list: | Priority | Role source | | --- | --- | @@ -41,9 +40,9 @@ For a non-admin Enterprise team member, Warp resolves the role in this order: | 3 | The applicable workspace or team default | | 4 | Editor, if no role or default is set | -The workspace default takes precedence over the team default when the workspace sets one. A default applies to new and existing members who have no assigned role. Changing a default does not replace a person's explicit team role or per-factory override. +Defaults apply to new and existing members without an assigned role. A workspace default takes priority over the team default. Explicit team roles and per-factory overrides stay unchanged. -Factory creation uses the team-level role, not a per-factory override. Team-level Editors and team or workspace admins can create factories. Editor access to one existing factory does not grant factory creation. +Team-level Editors and team or workspace admins can create factories. An Editor override for one factory doesn't let a teammate create others. ## Changing a team-level role @@ -54,21 +53,21 @@ You must be a team or workspace admin to assign User and Editor roles. 3. In the teammate's row, click their current seat type. 4. Choose **Factory user** or **Editor**, then click **Save**. -The role applies across the team's factories, except where the teammate has a per-factory override. +The role applies across the team's factories, except where the teammate has an override. ## Changing a role for one factory -As a team or workspace admin, give a teammate a different role in one factory: +Team and workspace admins can change a teammate's role for one factory: 1. In the web app, open that factory and click **Settings** > **Access**. 2. Find the teammate by name or email. In their role dropdown, choose **Factory user** or **Editor**. 3. Click **Save changes**. -The new role applies only to this factory. It does not change the teammate's team-level role or their access to other factories. +The change applies only to this factory. The teammate keeps their existing role in other factories. ## Factory permissions and external access -Factory roles govern who runs and configures the factory. They do not grant access to additional repositories or services. Each run uses the factory's configured [repository identity](/factories/factory-as-code/#credentialstrategy), [secrets](/factories/secrets/), and [MCP servers](/factories/factory-as-code/). +Factory roles don't grant access to repositories or external services. Runs use the configured [repository identity](/factories/factory-as-code/#credentialstrategy), [secrets](/factories/secrets/), and [MCP servers](/factories/factory-as-code/). Specification approval follows the foreman's instructions. Your repository's permissions and branch protection control who can approve and merge pull requests. See [Human decision points and permissions](/factories/factory-agents/#human-decision-points-and-permissions). From dc229e7c38ef89ea87a6d7bdc4e52cff82ccd91b Mon Sep 17 00:00:00 2001 From: yvjnlee Date: Tue, 27 Oct 2026 18:58:46 -0400 Subject: [PATCH 3/8] docs: show factory creation in capability table Clarify that creation uses the team-level role rather than a per-factory override. Co-Authored-By: Warp --- src/content/docs/factories/permissions.mdx | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/content/docs/factories/permissions.mdx b/src/content/docs/factories/permissions.mdx index 11d124d5e..105a04c56 100644 --- a/src/content/docs/factories/permissions.mdx +++ b/src/content/docs/factories/permissions.mdx @@ -14,6 +14,7 @@ Role management requires an Enterprise plan. On other plans, team members have E | Action | User | Editor | Admin | | --- | --- | --- | --- | +| Create factories (team-level role) | No | Yes | Yes | | View the factory and run work | Yes | Yes | Yes | | Edit the factory's name, handle, and definition | No | Yes | Yes | | Configure agents, repositories, and automations | No | Yes | Yes | @@ -21,6 +22,8 @@ Role management requires an Enterprise plan. On other plans, team members have E | Manage factory roles | No | No | Yes | | Delete the factory | No | No | Yes | +Factory creation uses your team-level role. An Editor override for one factory doesn't grant permission to create factories. + Team and workspace admins and owners inherit Admin access from their [team or workspace role](https://docs.warp.dev/enterprise/team-management/roles-and-permissions/). You can't assign Admin in a factory's role settings or reduce an admin's access with a User override. Editors can attach resources already connected to the team. Connecting team-wide integrations and managing shared runners require separate team or workspace permissions. @@ -42,7 +45,6 @@ For Enterprise team members who aren't admins, Warp uses the first role set in t Defaults apply to new and existing members without an assigned role. A workspace default takes priority over the team default. Explicit team roles and per-factory overrides stay unchanged. -Team-level Editors and team or workspace admins can create factories. An Editor override for one factory doesn't let a teammate create others. ## Changing a team-level role From 05a91be31deda957ded0a39ebcf3769aa93282bd Mon Sep 17 00:00:00 2001 From: yvjnlee Date: Tue, 27 Oct 2026 19:00:53 -0400 Subject: [PATCH 4/8] docs: simplify and reorder factory creation row Co-Authored-By: Warp --- src/content/docs/factories/permissions.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/factories/permissions.mdx b/src/content/docs/factories/permissions.mdx index 105a04c56..ab4fd9ae0 100644 --- a/src/content/docs/factories/permissions.mdx +++ b/src/content/docs/factories/permissions.mdx @@ -14,12 +14,12 @@ Role management requires an Enterprise plan. On other plans, team members have E | Action | User | Editor | Admin | | --- | --- | --- | --- | -| Create factories (team-level role) | No | Yes | Yes | | View the factory and run work | Yes | Yes | Yes | | Edit the factory's name, handle, and definition | No | Yes | Yes | | Configure agents, repositories, and automations | No | Yes | Yes | | Attach existing secrets, MCP servers, and integrations | No | Yes | Yes | | Manage factory roles | No | No | Yes | +| Create a factory | No | Yes | Yes | | Delete the factory | No | No | Yes | Factory creation uses your team-level role. An Editor override for one factory doesn't grant permission to create factories. From 0eb8da7e0f4e7b964312a8711e312b75a94c555d Mon Sep 17 00:00:00 2001 From: yvjnlee Date: Tue, 27 Oct 2026 19:06:32 -0400 Subject: [PATCH 5/8] docs: clarify factory web settings navigation Separate Factory web-app controls from desktop Settings paths checked by the technical-reference snapshot. Co-Authored-By: Warp --- src/content/docs/factories/permissions.mdx | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/src/content/docs/factories/permissions.mdx b/src/content/docs/factories/permissions.mdx index ab4fd9ae0..249611500 100644 --- a/src/content/docs/factories/permissions.mdx +++ b/src/content/docs/factories/permissions.mdx @@ -50,8 +50,8 @@ Defaults apply to new and existing members without an assigned role. A workspace You must be a team or workspace admin to assign User and Editor roles. -1. In the {VARS.FACTORY_WEB_APP}, open a factory and click **Settings** > **Access**. -2. Click **Manage team access**. +1. In the {VARS.FACTORY_WEB_APP}, open a factory and click **Settings**. +2. In the factory settings sidebar, click **Access**, then **Manage team access**. 3. In the teammate's row, click their current seat type. 4. Choose **Factory user** or **Editor**, then click **Save**. @@ -61,9 +61,10 @@ The role applies across the team's factories, except where the teammate has an o Team and workspace admins can change a teammate's role for one factory: -1. In the web app, open that factory and click **Settings** > **Access**. -2. Find the teammate by name or email. In their role dropdown, choose **Factory user** or **Editor**. -3. Click **Save changes**. +1. In the web app, open that factory and click **Settings**. +2. In the factory settings sidebar, click **Access**. +3. Find the teammate by name or email. In their role dropdown, choose **Factory user** or **Editor**. +4. Click **Save changes**. The change applies only to this factory. The teammate keeps their existing role in other factories. From f3310d111184901b72bc626e31776fcebf75d442 Mon Sep 17 00:00:00 2001 From: yvjnlee Date: Tue, 27 Oct 2026 19:09:33 -0400 Subject: [PATCH 6/8] docs: mention direct team admin route for factory roles Co-Authored-By: Warp --- src/content/docs/factories/permissions.mdx | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/content/docs/factories/permissions.mdx b/src/content/docs/factories/permissions.mdx index 249611500..370295c31 100644 --- a/src/content/docs/factories/permissions.mdx +++ b/src/content/docs/factories/permissions.mdx @@ -50,6 +50,8 @@ Defaults apply to new and existing members without an assigned role. A workspace You must be a team or workspace admin to assign User and Editor roles. +You can change team-level roles directly in your team's [Admin Panel](https://docs.warp.dev/enterprise/team-management/admin-panel/). The **Manage team access** link in factory settings opens the same member list. + 1. In the {VARS.FACTORY_WEB_APP}, open a factory and click **Settings**. 2. In the factory settings sidebar, click **Access**, then **Manage team access**. 3. In the teammate's row, click their current seat type. From 1e9abe2ebc58dc166614ce0549566a0c66571fbb Mon Sep 17 00:00:00 2001 From: yvjnlee Date: Wed, 28 Oct 2026 14:39:59 -0400 Subject: [PATCH 7/8] docs: apply factory permissions review feedback Use customer-facing role labels, explain role scope before restrictions, and clarify configuration and assignment procedures. Co-Authored-By: Warp --- .../factories/infrastructure-and-security.mdx | 2 +- src/content/docs/factories/permissions.mdx | 70 +++++++++---------- src/sidebar.ts | 2 +- 3 files changed, 35 insertions(+), 39 deletions(-) diff --git a/src/content/docs/factories/infrastructure-and-security.mdx b/src/content/docs/factories/infrastructure-and-security.mdx index 1172d4959..18e288d6c 100644 --- a/src/content/docs/factories/infrastructure-and-security.mdx +++ b/src/content/docs/factories/infrastructure-and-security.mdx @@ -100,7 +100,7 @@ Scope each credential to the resources and actions its agent needs. Warp redacts ## Factory roles and permissions -Assign User or Editor access to control who runs and configures a factory. Team and workspace admins inherit Admin access. See [Managing factory permissions](/factories/permissions/) for role details and assignment steps. +Assign Factory user or Editor access to control who runs and configures a factory. Team and workspace admins inherit Admin access. See [Managing factory permissions](/factories/permissions/) for role details and assignment steps. Factory roles don't control specification or pull request review. For factory definition changes, treat the files as operational code and protect merges through repository settings. diff --git a/src/content/docs/factories/permissions.mdx b/src/content/docs/factories/permissions.mdx index 370295c31..48d25380d 100644 --- a/src/content/docs/factories/permissions.mdx +++ b/src/content/docs/factories/permissions.mdx @@ -1,18 +1,34 @@ --- title: Managing factory permissions description: >- - Control who can run and configure Warp Factories with User and Editor roles, team defaults, and per-factory overrides. + Control who can run and configure Warp Factories with Factory user and Editor roles, team defaults, and factory-specific access. --- import { VARS } from '@data/vars'; -Give teammates User access to run work without changing the factory, or Editor access to configure its agents, repositories, and automations. The User role appears as **Factory user** in dropdowns. +Give teammates **Factory user** access to run work without changing the factory, or **Editor** access to configure its agents, repositories, and automations. -Role management requires an Enterprise plan. On other plans, team members have Editor access. +Assigning Factory user and Editor roles requires an Enterprise plan. On all other plans, team members have Editor access. -## Roles and capabilities +## Team-wide roles and factory-specific access + +A team-wide factory role applies to every factory on the team. To give someone different access to one factory, assign them a role in that factory's access settings. +For example, a teammate with Factory user access across the team can have Editor access to the payments factory they maintain. + +For Enterprise team members who aren't admins, Warp uses the first role set in this list: -| Action | User | Editor | Admin | +| Priority | Role source | +| --- | --- | +| 1 | The person's role assigned for this factory | +| 2 | The person's team-wide factory role | +| 3 | The applicable workspace or team default | +| 4 | Editor, if no role or default is set | + +Defaults apply to new and existing members without an assigned role. A workspace default takes priority over the team default. Changing a default doesn't replace a person's assigned team-wide or factory-specific role. + +## Roles and capabilities + +| Action | Factory user | Editor | Admin | | --- | --- | --- | --- | | View the factory and run work | Yes | Yes | Yes | | Edit the factory's name, handle, and definition | No | Yes | Yes | @@ -22,49 +38,29 @@ Role management requires an Enterprise plan. On other plans, team members have E | Create a factory | No | Yes | Yes | | Delete the factory | No | No | Yes | -Factory creation uses your team-level role. An Editor override for one factory doesn't grant permission to create factories. - -Team and workspace admins and owners inherit Admin access from their [team or workspace role](https://docs.warp.dev/enterprise/team-management/roles-and-permissions/). You can't assign Admin in a factory's role settings or reduce an admin's access with a User override. - -Editors can attach resources already connected to the team. Connecting team-wide integrations and managing shared runners require separate team or workspace permissions. - -## How roles apply - -A team-level role applies across the team's factories. Override that role for one factory to give a teammate different access there. - -For example, a teammate with User access across the team can have Editor access to the payments factory they maintain. - -For Enterprise team members who aren't admins, Warp uses the first role set in this list: - -| Priority | Role source | -| --- | --- | -| 1 | The person's override for this factory | -| 2 | The person's team-level Warp Factories role | -| 3 | The applicable workspace or team default | -| 4 | Editor, if no role or default is set | - -Defaults apply to new and existing members without an assigned role. A workspace default takes priority over the team default. Explicit team roles and per-factory overrides stay unchanged. +Permission to create factories depends on your team-wide factory role. Assigning someone Editor access to an individual factory does not let them create new factories. +Team and workspace admins and owners inherit Admin access from their [team or workspace role](https://docs.warp.dev/enterprise/team-management/roles-and-permissions/). You can't grant or reduce that access through a factory's role settings. -## Changing a team-level role +Editors can attach existing team secrets, MCP servers, and integrations to a factory. Connecting new team-wide integrations and managing shared runners require separate team or workspace permissions. -You must be a team or workspace admin to assign User and Editor roles. +## Changing a team-wide role -You can change team-level roles directly in your team's [Admin Panel](https://docs.warp.dev/enterprise/team-management/admin-panel/). The **Manage team access** link in factory settings opens the same member list. +You must be a team or workspace admin to change team-wide factory roles. Open your team's [Admin Panel](https://docs.warp.dev/enterprise/team-management/admin-panel/) to change roles directly, or follow the steps below to change roles from your factory settings. -1. In the {VARS.FACTORY_WEB_APP}, open a factory and click **Settings**. -2. In the factory settings sidebar, click **Access**, then **Manage team access**. +1. In the {VARS.FACTORY_WEB_APP} sidebar, expand the factory and click **Settings**. +2. Under **Settings**, click **Access**, then click **Manage team access**. 3. In the teammate's row, click their current seat type. 4. Choose **Factory user** or **Editor**, then click **Save**. -The role applies across the team's factories, except where the teammate has an override. +The role applies across the team's factories, except where the teammate has a factory-specific role. ## Changing a role for one factory Team and workspace admins can change a teammate's role for one factory: -1. In the web app, open that factory and click **Settings**. -2. In the factory settings sidebar, click **Access**. +1. In the {VARS.FACTORY_WEB_APP} sidebar, expand the factory and click **Settings**. +2. Under **Settings**, click **Access**. 3. Find the teammate by name or email. In their role dropdown, choose **Factory user** or **Editor**. 4. Click **Save changes**. @@ -72,9 +68,9 @@ The change applies only to this factory. The teammate keeps their existing role ## Factory permissions and external access -Factory roles don't grant access to repositories or external services. Runs use the configured [repository identity](/factories/factory-as-code/#credentialstrategy), [secrets](/factories/secrets/), and [MCP servers](/factories/factory-as-code/). +Factory roles don't grant access to repositories or external services. A run's access to those resources depends on its configured [repository identity](/factories/factory-as-code/#credentialstrategy), [secrets](/factories/secrets/), and [MCP servers](/factories/factory-as-code/). -Specification approval follows the foreman's instructions. Your repository's permissions and branch protection control who can approve and merge pull requests. See [Human decision points and permissions](/factories/factory-agents/#human-decision-points-and-permissions). +Factory roles don't determine who can approve specifications or merge pull requests. Specification approval follows the foreman's instructions. Your repository's permissions and branch protection rules govern pull request approval and merging. See [Human decision points and permissions](/factories/factory-agents/#human-decision-points-and-permissions). ## Related pages diff --git a/src/sidebar.ts b/src/sidebar.ts index 0c6299cd5..df2cc4eea 100644 --- a/src/sidebar.ts +++ b/src/sidebar.ts @@ -424,7 +424,7 @@ export const sidebarTopics: StarlightSidebarTopicsUserConfig = [ // agents and Factory skills, not just a filters reference. { slug: 'factories/automations', label: 'Factory automations' }, { slug: 'factories/factory-as-code', label: 'Definitions as code' }, - { slug: 'factories/permissions', label: 'Managing factory permissions' }, + { slug: 'factories/permissions', label: 'Factory permissions' }, { label: 'Infrastructure', items: [ From 1181dc085b8b61915f30263b9cbe866c17d82ce8 Mon Sep 17 00:00:00 2001 From: yvjnlee Date: Wed, 28 Oct 2026 15:07:44 -0400 Subject: [PATCH 8/8] docs: preserve reviewer wording in factory permissions Use the suggested prose verbatim except for the required Factory user label and the unintended blockquote marker. Co-Authored-By: Warp --- src/content/docs/factories/permissions.mdx | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/content/docs/factories/permissions.mdx b/src/content/docs/factories/permissions.mdx index 48d25380d..bee02970e 100644 --- a/src/content/docs/factories/permissions.mdx +++ b/src/content/docs/factories/permissions.mdx @@ -11,7 +11,7 @@ Assigning Factory user and Editor roles requires an Enterprise plan. On all othe ## Team-wide roles and factory-specific access -A team-wide factory role applies to every factory on the team. To give someone different access to one factory, assign them a role in that factory's access settings. +A team-wide factory role applies to every factory on the team. To override that role for an individual factory, assign the person a different role in that factory’s access settings. For example, a teammate with Factory user access across the team can have Editor access to the payments factory they maintain. @@ -40,13 +40,13 @@ Defaults apply to new and existing members without an assigned role. A workspace Permission to create factories depends on your team-wide factory role. Assigning someone Editor access to an individual factory does not let them create new factories. -Team and workspace admins and owners inherit Admin access from their [team or workspace role](https://docs.warp.dev/enterprise/team-management/roles-and-permissions/). You can't grant or reduce that access through a factory's role settings. +Team and workspace admins and owners inherit Admin access from their [team or workspace role](https://docs.warp.dev/enterprise/team-management/roles-and-permissions/). You can’t grant or reduce that access through a factory’s role settings. Editors can attach existing team secrets, MCP servers, and integrations to a factory. Connecting new team-wide integrations and managing shared runners require separate team or workspace permissions. ## Changing a team-wide role -You must be a team or workspace admin to change team-wide factory roles. Open your team's [Admin Panel](https://docs.warp.dev/enterprise/team-management/admin-panel/) to change roles directly, or follow the steps below to change roles from your factory settings. +You must be a team or workspace admin to change team-wide factory roles. Open your team’s [Admin Panel](https://docs.warp.dev/enterprise/team-management/admin-panel/) to change roles directly, or follow the steps below to change roles from your factory settings. 1. In the {VARS.FACTORY_WEB_APP} sidebar, expand the factory and click **Settings**. 2. Under **Settings**, click **Access**, then click **Manage team access**. @@ -68,9 +68,9 @@ The change applies only to this factory. The teammate keeps their existing role ## Factory permissions and external access -Factory roles don't grant access to repositories or external services. A run's access to those resources depends on its configured [repository identity](/factories/factory-as-code/#credentialstrategy), [secrets](/factories/secrets/), and [MCP servers](/factories/factory-as-code/). +Factory roles don’t grant access to repositories or external services. A run’s access to those resources depends on its configured [repository identity](/factories/factory-as-code/#credentialstrategy), [secrets](/factories/secrets/), and [MCP servers](/factories/factory-as-code/). -Factory roles don't determine who can approve specifications or merge pull requests. Specification approval follows the foreman's instructions. Your repository's permissions and branch protection rules govern pull request approval and merging. See [Human decision points and permissions](/factories/factory-agents/#human-decision-points-and-permissions). +Additionally, factory roles also don’t determine who can approve specifications or merge pull requests. Specification approval follows the foreman’s instructions, while your repository’s permissions and branch protection rules govern pull request approval and merging. See [Human decision points and permissions](/factories/factory-agents/#human-decision-points-and-permissions). ## Related pages