Tutorial 20

Set up multi-team isolation

Why this matters

Multi-team isolation is the Business-tier feature that turns Auxot from “a shared workspace” into “an organization with departments.” Each team owns its own agents, context files, credentials, tool policies, MCP servers, and API keys — but they all sit on the same Auxot license, the same AI providers, and the same governance backbone. Walls between teams, shared brain underneath.

If you’ve been running Auxot with a few teammates and watching things start to overlap (Marketing’s brand-voice context file showing up in agents Sales doesn’t need; Legal’s compliance notes bleeding into general support), it’s time to split. Today, you create one team and walk through what isolation actually means — what’s shared across teams, what’s not, and how to think about the divide.

Quick start

1. Sign in — open Auxot in your browser and log in.
2. Open Teams settings — click Settings in the left menu, then Teams.
3. Click + New Team — top right of the Teams card.
4. Name and describe the team — Name (required, e.g., “Customer Support” or “Marketing”), Description (optional but recommended).
5. Add members — expand the new team’s row, use Add Existing User for current org users or Invite by Email for new ones. Pick a role for each: Member, Admin, or Owner.

Done? Your new team appears in the teams list with its members. From here, you’d configure the team’s own agents, context files, credentials, and tool policies (Tutorials 04, 07, 08, 17).

The agent can do that?

Team structure is a governance decision — the Admin Agent helps you reason about it.

1. Have the Admin Agent recommend your team structure

Open chat with the Admin Agent and try this:

My organization is [brief description — e.g., "30-person consulting firm doing strategy, design, and implementation work"]. We've been using Auxot as one shared workspace and now want to split into teams. What team structure would you recommend? Give me three to five teams with names, what each one does, and which existing agents would belong to each.

Why it’s non-obvious: The Admin Agent reads what you’ve already built (agents, context files, credentials) and proposes a team layout that fits the work, not just the org chart. You go from “we should probably have teams” to “here are exactly four teams with these names and these agents in each” — without having to design the layout yourself.

2. Have the Admin Agent draft each team’s “what we do here” statement

Once you’ve created teams, write down what each one is for so members joining later understand:

For each of these teams [paste team names], draft a two-or-three sentence "what this team does, what kinds of work belong here, and what doesn't" statement that I can save as a team-scoped context file. Make it sound like a real team would write it, not corporate.

Why it’s non-obvious: Teams without a stated purpose drift over time — agents get added that don’t fit, context files accumulate that nobody references. A short statement at the top, saved as that team’s first context file, keeps the boundary clear. The Admin Agent uses what you’ve built and what you’ve described to make each one specific.

3. Have the Admin Agent audit who’s in which team

Once you have multiple teams, ask:

Look at my team structure and who's in each team. Are there people who should be on a team they're not? Are there people on teams they don't really need to be on? Are there teams with only one member that should probably be folded into another? Be specific.

Why it’s non-obvious: Team membership decays. Someone joins for one project and stays after, or moves roles but their team membership doesn’t catch up. The Admin Agent reads who’s where and what they actually do, and flags the staleness — saves you scheduling a quarterly access review.

Go deeper

What’s team-scoped vs org-scoped vs personal

Three layers of scope, and most resources can sit at any of them:

• Org scope — visible to everyone in the organization. Use for company-wide things: brand voice, top-level brand context files, the AI provider connections.
• Team scope — visible only to members of that team. Use for team-specific things: that team’s agents, their internal docs context files, their own API keys, their team-tier integrations.
• Personal scope — visible only to you. Use for individual workflows.

A user can be on multiple teams simultaneously with different roles in each (Member of Engineering, Admin of an internal tools squad). Team membership is independent across teams.

Role hierarchy within a team

• Member — uses the team’s agents and shared resources.
• Admin — configures the team’s agents, tool policies, and context files; manages team membership.
• Owner — same as Admin, plus exclusive authority over membership and role changes for the team.

Org-level roles (User vs. org Admin) are independent of team-level roles. Someone can be a regular org User and still be the Owner of a specific team. (Tutorial 06 covers the org-level hierarchy.)

What’s NOT isolated by team: AI provider connections (cloud OpenAI/Anthropic accounts you’ve added at Settings → Providers), the org-level Audit Logs (org admins still see everything), and license/billing.

Troubleshooting

• “+ New Team” button is grayed out or missing. You’re on Free or Team tier (one default team only) — Business+ unlocks team creation. Or your org role isn’t Admin.
• A user I added to a team can’t see the team’s agents. Check that the agents themselves are scoped to that team. Adding a user to a team gives them access to team-scoped resources; agents that are personal-scoped or scoped to a different team stay invisible.
• A user is on multiple teams and is confused about what they have access to. That’s expected — their access is the union of all their teams’ scopes plus any org-scoped resources. The Admin Agent can audit this for them: “What does my Auxot access look like across all my teams?”

Variations & edge cases

• Inviting someone by email creates a 7-day invite link. They click, sign up, land in your org and on the team you specified. Revoke the invite from the team’s pending invites list if plans change.
• Removing someone from a team doesn’t remove them from the org. They stay as an org user; they just lose that team’s resources.
• Deleting a team doesn’t delete its members. Members revert to whatever org-level access they had. Team-scoped resources (the team’s agents, context files, etc.) are deleted with the team — back them up if you want them.
• Free tier and Team tier: single implicit default team, no UI for creating more. The teams settings page may show a “Compare plans” upsell if you’re on these tiers.
• Default team can be renamed. It exists implicitly on every account; on multi-team plans you can rename it from a generic name to something like “Operations” or “HQ.”

Walkthrough

Step 1: Sign in

Open Auxot in your browser and sign in. You need to be an org admin to create or delete teams.

Step 2: Open Teams settings

Click Settings in the left menu, then Teams. You’ll see your existing teams (at minimum, your default team) plus a + New Team button at the top right.

Step 3: Click + New Team

A modal appears titled New Team. The description reads: “Create a team to group users and agents.” Two fields:

• Name — required. Pick something specific to the work, not the people (e.g., “Customer Support” or “Marketing,” not “Sarah’s Team”).
• Description — optional but recommended. One line that says what this team handles.

Click Create. The team appears in the list.

Tip: If you’re not sure how to structure your teams, run Power Move 1 above first. The Admin Agent will recommend a layout based on your existing agents and how you describe your business.

Step 4: Add members

Click the new team’s row to expand it. Three sections appear:

• Members — currently empty.
• Add Existing User — dropdown of users already in your org, role picker (Member / Admin / Owner), Add button.
• Invite by Email — email field, role picker, generates a 7-day invite link the new user clicks to sign up and join the team.

Pick a starting role for each person — Member is fine for most; reserve Admin and Owner for people who’ll manage the team’s configuration and membership.

Tip: Same person, different teams, different roles is fine and often correct. The CTO might be a Member of Engineering (because they don’t run the day-to-day) and an Owner of the Leadership team.

Step 5: Set the team’s first context file (optional but recommended)

Once the team has members, head to Settings → Context Files and create a team-scoped context file titled “What this team does.” Use Power Move 2 above to draft it. Attach it to all of this team’s agents (when you build them). New people joining the team see the team’s purpose immediately reflected in agent answers.

Step 6: Build the team’s agents and tool policies

This is where the team starts doing real work. Tutorials 04, 07, 08, and 17 cover the full setup — each one supports team scoping, so when you build an agent now, set it to this team’s scope and it’ll be invisible to everyone else.

What’s next

• → Tutorial 06: Invite your first teammate — if you haven’t yet brought additional people into Auxot.
• → Tutorial 11: Create a shared Team API Key — Team API keys are how automations authenticate as a team (instead of as an individual).
• → Tutorial 17: Manage your Credentials — credentials can be team-scoped, so each team uses its own keys.

Reference

• Pages in Auxot: Settings → Teams
• Tier required: Business or Enterprise (Free / Team tier = one default team only)
• Team roles: Member / Admin / Owner
• What’s team-scoped: agents, context files, credentials, tool policies, MCP servers, API keys, OAuth providers
• What’s org-scoped: AI provider connections, audit logs, license/billing
• Invite expiry: 7 days (revocable from pending invites list)
• See also: Tutorial 06: Invite your first teammate, Tutorial 11: Create a shared Team API Key, Tutorial 17: Manage your Credentials