> ## Documentation Index > Fetch the complete documentation index at: https://www.cloudtag.tech/llms.txt > Use this file to discover all available pages before exploring further. # Control who can use and configure it > Roles in Cloud Tag (Owner, Admin, group admin, member), who can ask the agent for something, which groups a mailbox can join, and how to mute it, remove it from a group, delete a group, unlink a mailbox or delete an organization. The agent responds only in groups it has joined, and, unless a group is set to respond automatically, only to mail addressed to it there. Who configures it is set by roles in Cloud Tag. ## Roles | Role | Claude Tag equivalent | What they can do | | --- | --- | --- | | **Owner** of an organization | Owner | Everything Admins can, plus add and remove Owners and Admins, and allow fast mode | | **Admin** of an organization | Claude Tag admin | The API key, linked mailboxes, defaults, spend limits, organization-wide connectors, repositories, skills, secrets and auto-approve rules, bundles, shared notes, and every group in the organization | | **Group admin** | Channel manager | Everything on that group's pages: instructions, model, connectors, repositories, secrets, network, skills, files, memory, approvals and auto-approve rules, routines, its admins, deletion and its spend limit (up to the organization's default) | | **Participant** in group email | Channel member | Use the agent through the group. Posting does not grant access to Cloud Tag's group pages or file downloads | - Add Owners and Admins on the organization page under **Owners and Admins** (Owners only), by Google account email. - An organization must keep at least one Owner. You cannot remove its last Owner or change them to Admin, including through **Add Owners and Admins**. - Add group admins on the group's **Admins** page. Joining or activating a group does not create an independent Group-admin grant. Current organization Owners and Admins already manage its groups. - Removing an organization role removes its inherited Group access. Explicit Group-admin grants remain; the organization page lists them, including people with no organization role, and lets you revoke them separately. - Historical activation grants are no longer authorization. Earlier activation and admin-add flows could overwrite or obscure their provenance; re-add a person on **Admins** if they need an independent grant. - Everyone signs in to the settings site with Google. The first time anyone signs in, Cloud Tag also creates an empty organization for them and opens it. Group admins don't need that organization: open the group from a reply's **Configure** link again. Shared group pages, history, files, memory, pending approval details and audit records require a current organization Owner/Admin role or a Group-admin grant. Past posts do not establish current Google Group membership or read permission. Instructions and reply mode are admin settings; the former member-edit option no longer grants access. Private DMs remain accessible only to their participant. The team that runs the Cloud Tag platform has an operator page showing each organization's metadata (who runs it, its agents, group counts, spend), but no access to any organization's groups, mail or settings. To get support, add them as an Admin. ## Shared-note write access Only current organization Owners and Admins can grant or revoke a Group's ability to update its agent's shared notes, from the organization page under the agent. Group admins can manage their Group's own notes but cannot authorize writes across Groups. A Group's Overview shows its effective access. Earlier checked write settings need fresh organization approval and run read-only until then. Changing access retires existing sessions before they can continue; an already-running remote invocation may finish while retirement settles. Review existing shared notes before approving writers: this change does not remove earlier content or establish per-note provenance. Private DMs never mount agent shared notes. ## Who can ask the agent for something Anyone whose mail reaches the group can mention the agent. Cloud Tag adds one check: it believes group mail only when Gmail's own authentication shows that the group's domain sent it. Group mail that fails is ignored, and the last week of it is listed on the organization page. A copy sent straight to the agent without passing through the group is accepted only from a known member whose mail passes DMARC. To limit who can use the agent in a group, limit who can post to the group in Google Groups. ## Which groups it can join - A **Google Workspace** mailbox joins only groups on its own domain. - A **personal Gmail** mailbox joins only public groups on `googlegroups.com`. - Several agents can be in one group, even from different organizations. Each is turned on separately, and each organization sees only its own agent's copy of the group. - It joins only when an Owner or Admin answers **Yes** to the join email, or clicks **Turn it on now** on the group's Overview. See [Add the agent to a group](https://www.cloudtag.tech/docs/admins/setup-overview.md#add-the-agent-to-a-group). ## Who can ask it Like a Slack channel, only the group's members get the agent, because it answers from the group's history, files, memory and connectors. Google Groups can let people post who can't read the group (**Who can post: Anyone on the web** or **Entire organization**), so being able to post isn't enough. - **Members:** the people Google lists in the group, checked with the agent mailbox's own sign-in. Google must let members see the member list. - **Always:** the organization's Owners and Admins, and the group's admins. - **Anyone else** gets no answer, and the group's admins get an email (once a day per person, and about at most five people a day). An admin can **Allow** them on the group's **Admins** page, and the agent then answers what they asked. **Revoke** or **Dismiss** turns them away without further emails. - **Commands** such as `!fork #other` act in another group only for its members too. - **Public `googlegroups.com` groups** have no member list Google shares, so there everyone outside the admins needs to be allowed this way. - **Forged senders get nothing.** The agent believes the person's address only if Gmail verified it when the post reached the group: DMARC passed, or the post carried a DKIM signature from the person's own domain. Google Workspace signs its users' mail this way once DKIM is turned on. - The agent replies to the group itself, so who reads its answers is still up to the group's own membership. ## Mute it - **One thread:** anyone sends `@cloud !mute`, and `@cloud !unmute` to resume. - **A whole group:** a group admin turns on **Mute** on the group's Overview page. It keeps reading and storing mail, never replies, and runs no routines. ## Remove the agent from a group Remove the agent's address from the group's members in Google Groups. It stops receiving the group's mail. The group's settings, history and files stay in Cloud Tag; add the address back (directly, with delivery set to Each email) and it picks up again. ## Delete a group A group admin or an organization Owner or Admin opens the group's **Overview**, finds **Delete group**, types the group's email address and clicks **Delete group**. This permanently removes the group's stored history, settings, roles, files, routines, approvals and queued replies from Cloud Tag. Deletion first disables the group, retires its sessions and confirms cleanup of its own credentials and remote resources. While cleanup is pending, data and accounting stay available; confirm deletion again after cleanup finishes. Inherited credentials are preserved. Other groups, the mailbox and shared resources stay. Submitted feedback, a deletion record and current-month incurred spend are retained. See [Data lifecycle](https://www.cloudtag.tech/docs/concepts/data-lifecycle.md) for external data that stays. First remove the agent's address from the group in Google Groups. Deleting here does not delete the Google Group or unsubscribe the agent; later mail can create a fresh pending group that needs approval again. Work already running and mail already being sent may finish. ## Unlink a mailbox On the organization page, open the agent and click **Unlink**. Cloud Tag discards its Gmail sign-in and stops reading the mailbox. To revoke access on the Google side too, remove Cloud Tag from the third-party apps in the mailbox's Google Account security settings. Its groups keep their history. Linking it again picks up mail that arrived while it was unlinked (the last three days, if it was unlinked for over a week) and answers anything addressed to it. An unlinked mailbox stays reserved for your organization. To let another organization link it, an Owner clicks **Release address** under the unlinked agent. Its groups and their history stay with your organization; releasing can't be undone, and to use the mailbox here again you link it as a new agent. If Google revokes the mailbox's access, the agent shows **link again** on the organization page. Click **Link again** and sign in as the mailbox. ## Delete an organization Ask the platform operator. They delete it after typing its name; see [Data lifecycle](https://www.cloudtag.tech/docs/concepts/data-lifecycle.md). ## Not built yet - Limiting use to people in your organization, or to certain roles. Today, anyone who can post to the group can use the agent. - Direct messages. Every conversation is in a group. - Managing a group's instructions from another group ("Managed by"). [Bundles](https://www.cloudtag.tech/docs/admins/attach-to-scope.md) are the nearest thing: one set of instructions for many groups.