Invite a teammate or agent
Use this when a vault should be part of the full KB-1 experience: Cloud login, organization membership, signed entry, and shared presence. Local-only daemon mode does not use Cloud organization invites.
What exists today
Section titled “What exists today”An organization admin can invite another person by email from the Organizations
surface. The invited account accepts an invitation link, becomes a member, and
can enter the org’s vaults through the authenticated Cloud app. Admins can also
resend or cancel pending invitations, change roles, remove members, rename the
org, and opt into Google Workspace auto-admit when their account has a Workspace
domain.
Agent access is usually configured through MCP on a machine or account you control. Do not share a personal password or relay token with an agent. Add the human or service account that owns the agent runtime, then configure that runtime using the agent setup docs.
Add a teammate
Section titled “Add a teammate”- Sign in as an organization admin.
- Open the Cloud app and switch the left rail to Organizations.
- Expand the organization that owns the vault.
- Open Members.
- Enter the teammate’s email and choose
memberoradmin. - Send the invitation.
- Copy or send the invitation link if email delivery is not available in your environment.
- Confirm the teammate appears in the member list after accepting.
If the invite is wrong, cancel it from the pending invitations list and send a new one.
Connect an agent safely
Section titled “Connect an agent safely”For local-only or self-hosted work on the same machine, connect the agent to the daemon MCP endpoint:
http://127.0.0.1:7382/mcpFor team workflows, decide who is responsible for the agent runtime. That person or service account should be an org member, and the agent should use the KB-1 surface that matches where it runs:
| Agent runtime | Recommended access |
|---|---|
| Same machine as daemon | Local MCP over loopback. |
| Trusted private network | Local MCP over the private address you explicitly expose. |
| Self-hosted full experience | Cloud login for the human/team surface, plus daemon MCP where the agent runs or Cloud MCP when your deployment enables it. |
| Hosted full experience | Cloud login for the team surface, plus Cloud MCP when your deployment enables the MCP worker. |
Confirm access
Section titled “Confirm access”Ask the new member to sign in and open the shared vault. The success signal is that the vault appears in their app and they can open the expected note path.
For agents, the success signal is more concrete: the client can list vaults, read a harmless note, and write only the scratch note you choose for the test.