A token is not a person.

Every client token belongs to a person and workspace. Rayrun records each call against that person, even after the token is revoked.

Workspace roles control who can manage services and shared credentials. Tool policies control what each connected client can run.

Who can add, and who can only use.

  • Owner

    • Billing and the plan
    • Everything an admin can do
    • Deleting the workspace

  • Admin

    • Add a service and authorize it
    • Author and deploy hosted tool hooks
    • Invite people and assign roles
    • Decide who reaches what

  • Member

    • Use authorized services
    • Read the activity log
    • Work without seeing secrets

Decide what happens when each tool is called.

Set one default for a service, then change any individual tool. A connected client can choose less access, never more, so a broad client setting cannot bypass the workspace.

  • Allow

    Run without stopping for approval.

  • Ask

    Require approval before that exact call leaves ray.run.

  • Block

    Keep the tool out of reach.

Ask is approval for one exact call, not a temporary window. If its arguments, policy, client, or tool version change, the approval cannot be reused.

A dynamic Code Mode call pauses and resumes the same in-memory execution, so work that already happened is not repeated. Direct Mode retries must carry Rayrun's server-issued continuation state and the authenticated browser decision.

Decide what the model gets back.

A tool can be safe to call and still return far more than the task needs. Choose output fields from the tool's schema and ray.run exposes the reduced contract, then applies the same allowlist in Direct Mode and Code Mode.

Response shaping never runs arbitrary code. Every projected call records the exact allowlist digest and before-and-after byte counts, so Activity shows what ran and how much data it withheld.

When a tool needs executable contract, argument, or result adaptation, hosted TypeScript hooks run in a separate capability-free sandbox. Hooks can reject a call or add approval, but cannot weaken access policy. How hosted tool hooks work.

Shared credentials require an administrator.

Only an owner or admin can authorize a credential shared by the workspace. Members can authorize their own account when a service uses per-person identity.

Every activity row identifies the person and client that made the call.

Offboarding revokes access.

Remove someone from the Members page and their Rayrun access and refresh tokens stop working immediately. Their browser leaves that workspace and their connected clients lose access.

A shared upstream credential they supplied is cleared for an administrator to review and authorize again.