Access Control for Agent-Generated Work: Who Can Open What Your Agents Produce

Three failures this model exists to prevent

Access control for agent work is abstract until it fails. It fails in three recognizable ways.

An agent published a customer report to the wrong audience. The agent did what it was asked. The link it returned was public, because public was the only option that did not require the reader to buy a seat. The report held customer names. Nobody noticed until a customer did.

The feedback no longer matches the page. A reviewer commented in Slack on Tuesday. The agent published a new version on Wednesday. On Thursday a second reviewer read the Slack thread, opened the page, and could not find what the first comment referred to.

The next agent cannot tell what changed. Version 3 is live. Version 2 was fine. Nobody can say who published version 3, from which tool, or whether a person or an agent did it.

Each failure has the same root. The page had a link, and it did not have an owner, an audience, or a record.

The model in one table

Display is the AI docs workspace that's open to all agents and people. Teams and their agents create docs in Spaces and folders, and you set the access for each doc and folder. Display gives each published page, which we call an artifact, one audience, one sign-in path per reader, and one record. The publisher chooses the audience when they publish, and can change it later. The URL stays the same.

The Free plan includes 3 Company or Private artifacts. Public artifacts are unlimited on every plan. Viewers are unlimited on every plan.

Who counts as "the company"

A Company artifact opens for members of your organization. Membership comes from a verified company email domain, not from a list. An Owner adds the domain and verifies it through DNS. From then on, anyone who signs in with an address at that domain is a member. A new hire is a member on their first day. Nobody maintains a roster.

The Business plan includes additional domains. One organization can hold several domains, which covers a company with more than one brand.

Sign-in uses the account the reader already has. On Solo and higher plans, that is Google Workspace or Microsoft Entra ID. On every plan, the reader can instead enter a one-time password sent to their email address. Enterprise adds SAML for organizations that run their own identity provider.

The reader who is not in the company

The audience that vendor sharing handles worst is the named outsider. A client. A contractor. An auditor. Someone who must open one page and nothing else.

On Display, the publisher invites that person by email to the artifact, or to a folder, and gives them a role: Viewer, Commenter, Contributor or Editor. The person receives a notification. When they open the page, they sign in with a one-time password, Google or Microsoft. They do not join your organization. They open only what you invited them to. The link alone does not open the page for anyone else, because the reader must sign in with the invited email address.

This is the shape a shared password cannot give you. A password is a secret that anyone can forward. An invitation is a person.

What the reader never sees

Two rules protect the audience beyond the sign-in.

A denial reveals nothing. When someone who is not in the audience opens a Company or Private artifact, Display does not reveal whether the artifact exists. There is no page that says "this exists, but not for you."

A role is not a key. Organization roles control administration. Owners manage billing, roles, sign-in, and domains. Admins manage members and public or company artifacts. Members publish. None of those roles grants access to the content of a Private artifact. A Private artifact can be read only by its creator and the people invited to it. An Admin who was not invited cannot open it. Administration and reading are separate on purpose.

What the record holds

The third failure, the version nobody can explain, is answered by the audit log and by attribution on the artifact itself.

Every version is attributed. The version history names the actor behind each version and the surface it came from. A version published by an agent through MCP is recorded as an agent action, with the agent's name. A version published by a person from the dashboard is recorded as that person. A comment names the person who left it.

The audit log records the lifecycle. On Business and Enterprise, the organization's audit log records each of these events, with the actor, the source, and the time:

• an artifact was published, updated, renamed, or deleted
• an anonymous artifact was claimed into the organization
• a version was rolled back
• the audience changed, or a person was invited or removed
• someone in the audience opened the artifact
• someone outside the audience was denied
• a member's role changed, or a member was removed

Business keeps these events for 365 days.

Who opened it, by name. On Team and Business, the artifact's view record shows which signed-in person opened it and when. Solo shows counts. Public artifacts record anonymous views as counts only. A signed-in reader can also see who else has the artifact open at that moment. Presence follows the audience, so it never shows a reader anything they could not already open.

How access changes over time

Work does not stay still, and neither does its audience.

The audience changes, the URL does not. Move an artifact from Private to Company when the draft is ready. Move it to Public when it is meant for customers. Move it back. Every change is recorded, and the address people already have keeps working for the people who are still allowed.

Comments stay on the page. A reviewer comments on the artifact, not in a chat. The next agent reads the comment through MCP, publishes the next version to the same URL, and resolves the thread. The comment and the version it refers to stay together. A teammate can also select Edit and correct a line on the page, and the save becomes a version like any other. Invited guests work in the role you give them: Viewer, Commenter, Contributor or Editor.

Versions stay available. Paid plans keep earlier versions, and every retained version counts toward storage. A retained version can be opened or exported. A rollback is recorded like a publish.

The organization keeps the work. Artifacts belong to the organization. When a member leaves, their published work does not leave with them. See Members and roles for the offboarding steps.

Where each vendor's own sharing stops

Every agent vendor now offers some way to share output. Each one stops at the same line: the reader needs an account on that vendor, or the page is public.

Stacktree comes closest on gates. Its own comparison page, last updated 20 September 2026, says:

"If your primary requirement is 'every viewer must be in our IdP,' and you want every artifact across the org auto-gated to your SSO without per-link configuration, Display.dev's workspace model is a tighter fit today."

Each row links to a fuller treatment: Claude artifacts, ChatGPT Sites, Stacktree, Palette, and Workplane.

What this model does not do

Two limits, stated plainly.

Access is a person or an audience. On Display, you give access to people, groups or an audience, never to a secret that someone can forward. Stacktree offers passwords on links, expiry timers and burn-after-read. If a single-use secret link is the whole job, Stacktree fits it.

The organization-wide switch is on Business. On every plan, the publisher chooses the audience for each artifact. On Business, an Owner also sets one policy for Public links and outside invitations across the organization, and the audit log records each choice.

Getting started

Ask your agent to publish one file and set its audience at the same time:

"Publish ./report.html to Display for everyone at my company."

Or invite one outside reader:

"Publish ./report.html to Display as private and share it with client@example.com."

The same choices are available from MCP in Claude Code, Codex, Cursor, and Claude, and from the dashboard. Company sign-in with Google and Microsoft starts on the Solo plan at $9 a month, billed yearly. Every plan is a flat price per organization, with unlimited viewers.

Get started free – 3 gated artifacts on the Free plan, unlimited viewers, no card required.

Product behavior in this post reflects Display's documentation on 22 September 2026. Competitor claims reflect each vendor's public documentation on the same date. We updated Display's plans, sign-in and sharing on 28 October 2026. See the linked pages for sources.

Sources and further reading

• Sharing and access
• Members and roles
• Company email domains
• Sign-in providers
• Plans and limits
• What is gated publishing?
• How to know if someone opened your link, and who
• Why per-seat pricing kills internal sharing