Access and context
One identity, a Workspace Membership as the whole grant, and an explicit Build on every command.
One identity
You act as your BWorlds Builder identity, the one you sign in with in the app. A user session and a personal token in an automated runner resolve to that same identity. A token creates no separate agent account and no second set of rights. Operator describes a Builder using the CLI, directly or through an agent; it is not a stored role.
Membership is the grant
A Workspace Membership is the complete operational grant. As Owner or Member you have the same CLI rights to read and act on every Build the Workspace owns. There are no per-Build permissions, operator levels, or permission matrix to configure. Verified platform administrators are the separate server-side exception and can reach Build operations without a Membership.
The Owner manages this from Workspace sharing at https://app.bworlds.co/account/team: invite an email address, cancel a pending invitation, remove a Member. You accept the single-use link with your own identity. The same page shows Members the Workspaces they joined.
The server reloads Memberships on every request. When an Owner removes you, their Builds disappear from bworlds auth status at once and every request from your session or your tokens is rejected, without waiting for anything to expire. Your identity and your other Workspaces are unaffected.
Outside your Workspaces, nothing exists
Anything outside your Workspaces is reported as not found, whether you list it or name it directly: Builds, Audit runs, Findings, Dossier documents, telemetry. A not_found on an identifier you were given usually means a missing Membership, so check bworlds auth status before assuming the identifier is wrong.
Name the Build every time
Every Build command takes the Build slug explicitly. Before you act, confirm what you are targeting:
bworlds auth status
bworlds build info BUILD_SLUGThe second command names the acting identity, the Workspace, and the Build in one screen. This matters most when you belong to several Workspaces, including your own. The CLI never infers a Build from the folder you are in.