# Permissions

> Who may do what in a workspace, in one place, part by part — repositories, teams and chat — and what each setting does.

**Permissions** is where a workspace's owners decide who may do what, part
by part: `g1t.sh/<workspace>/-/permissions`, under **Workspace → Access**
in the sidebar. Only owners can open it. Each part of g1t has a card, each
setting says what it decides, and each card saves on its own with its
**Save** button; the change holds on everyone's next request and is
recorded in the [audit log](/guides/audit-log/).

## Code

| Setting | What it decides | Today |
| --- | --- | --- |
| **Base permission** | The role every member has on each of the workspace's repositories: **No permission**, **Read**, **Write** or **Admin**. Owners are Admins on all of them, and a role given to someone on one repository adds to this; it never takes away. See [the base permission](/guides/access-and-roles/#the-base-permission). | A new workspace starts at **Read**. |
| **Members can create public repositories** | Whether any member can create a public repository. | On |
| **Members can create private repositories** | Whether any member can create a private repository. Whoever creates one is its Admin. | On |
| **Repository admins can change visibility** | Whether a member with Admin on a repository can make it public or private. | On |
| **Repository admins can delete and transfer repositories** | Whether a member with Admin on a repository can delete it, or transfer it to a workspace where they can create one. | Off |
| **Repository admins can add outside collaborators** | Whether a member with Admin on a repository can give a role on it to someone outside the workspace. | On |

The five switches are the workspace's
[member privileges](/guides/workspaces/#member-privileges), the same ones
`GET /workspaces/{workspace}` returns by name (`members_can_…`). When one
is off, only owners can do it; the refusal says so.

## People and teams

| Setting | What it decides | Today |
| --- | --- | --- |
| **Who can create teams** | **Any member** with a confirmed email address, or **Owners only**. Whoever creates a team becomes its first maintainer; teams that already exist stay as they are. See [who can create teams](/guides/teams/#who-can-create-teams). | Any member |

## Chat

| Setting | What it decides | Today |
| --- | --- | --- |
| **Workspace channels** | Who can create channels anyone in the workspace can join: **Any member** or **Owners only**. Public channels, open to anyone on g1t, are always made by owners. | Any member |
| **Private channels** | Who can create them: **Any member** or **Owners only**. | Any member |

Renaming and archiving channels, custom emoji and default channels are on
[Chat settings](/guides/chat/#workspace-chat-settings), under **Workspace →
Chat**: they are about what a channel's own members may do, not who may do
what in the workspace.

## Through the API

Every setting is set the way it was before it had this page:

| Setting | Route | MCP |
| --- | --- | --- |
| Base permission | [`PUT /workspaces/{workspace}/base_permission`](/reference/api/access/set-base-permission/) | `access` `set_base_permission` |
| Member privileges, who can create teams | [`PATCH /workspaces/{workspace}`](/reference/api/workspaces/update-workspace/) with `members_can_…` or `team_creation` | `workspace` `update` |
| Public and private channels | The chat service's workspace settings, as [Chat settings](/guides/chat/#workspace-chat-settings) saves them | |

## Next

- [Access and roles](/guides/access-and-roles/): what each role can do on a repository.
- [Workspaces](/guides/workspaces/#workspace-mode): every page of Workspace mode.
- [Audit log](/guides/audit-log/): where each change is recorded.