---
title: "Access and permissions"
canonical: https://workspace.socra.com/docs/cortex/administration/access-and-permissions
---

# Access and permissions

Cortex authorizes every operation within one Account and applies the permissions of the authenticated principal.

## Account boundary

An Account is the customer-owned organizational and authorization boundary. A person can belong to more than one Account, but Cortex resources and operations do not cross Account boundaries.

The Account selected during [OAuth](/docs/cortex/administration/security#oauth-credentials) determines which Cortex data the integration can access. Changing the active Account in one client does not silently change another client's stored grant.

## Principals

A normal OAuth connection acts as the signed-in Account member. An Account Agent is a distinct principal used only when an integration provisions and connects one explicitly. Separately provisioned Account Agents appear in [Admin's Agents directory](/docs/admin/guides/review-agents-and-apps#review-agents).

Do not describe a human OAuth grant as an Agent identity. The two principals have different provenance even when they participate in the same work.

## Module access

[Modules](/docs/cortex/concepts/modules-and-map) are public within the Account by default and can be private by exception. Module-level grants are the intended authorization boundary, but the complete granular grant layer is not yet available on every Cortex surface.

Until a documented surface exposes a specific grant operation, do not assume that creating a private Module provides a fully configurable role system.

## Cloud Projects

The [first-party coding-agent integration](/docs/cortex/integrations/coding-agents) uses OAuth clients owned by Socra's `agent-plugins` Cloud Project. The customer authorizes an Account and does not create a Cloud Project for this path.

Custom applications remain Project-owned integrations. Create or select the application’s [Cloud Project](https://platform.socra.com/projects), then follow the [custom MCP guide](/docs/cortex/guides/mcp) when the application needs its own OAuth client, attribution, and service-consumption boundary.