Access levels

Three levels, and they are cumulative: Control does everything View does, Edit does everything Control does. One level does not exist for one kind: a client is never shared at Edit.

What the levels mean

	View	Control (adds)	Edit (adds)
Client	see its status and console	start it, stop it, run a flow on it now	not offered: its name, server, version and the flows it runs stay yours to change
Flow	see it and read its blocks	run it now on a client they control	edit its blocks, rename it
Dedicated IP	see its label, host, port and health, never the password	attach it to a client they control	rename it and change its settings

That is the table the share dialog shows while you pick. Two rules bound it:

1. A grantee can only combine resources they can already reach. Running a flow needs both the flow and the client: a flow share says nothing about the clients that flow happens to be attached to. Clients the caller cannot reach are quietly left out of the run rather than failing it. Your one private client on an otherwise-shared flow must not make the flow unusable for them.
2. A dedicated IP password is never returned, at any level. Once set it is write-only.

What each level actually does today

The table above is what the levels are for. Some of it is not wired up yet. Everything here fails closed (a grantee never sees more than they should), but a level can quietly deliver less than its description, and it is better to know which.

Client has no Edit level. An invite or a level change to Edit on a client is refused: renaming it, changing its server or version, and choosing its flows stay owner-only regardless of what a grantee holds, so there is nothing an Edit grantee could do that Control cannot.

Client View reaches the client's own page, console included. A shared client shows up on the grantee's Crew page, marked with who shared it, and opens to its own page: real status, vitals and the live log stream. At View the console is read-only: sending a command needs Control.

Client Control is start and stop, on the Crew page and on the client's own page. The Shared list carries no live status, so a button pressed there answers Start sent. rather than what the client did; the Crew page and the client's own page show it happen.

Dedicated IP View is a look, nothing more. It shows up under Dedicated IPs on the Crew page with its label, address and health, never the password. A Control grantee gets more: the dedicated IP picker lists the ones you can reach, shared ones included, so a client's dedicated IP field can be pointed at one someone else owns and shared with you at Control. The api checks exactly that level when the attach happens. Testing it works from the Shared page or the client drawer too.

Dedicated IP Edit can rename it, from its drawer. Opening a shared dedicated IP's drawer offers a rename control to an Edit grantee, same as an owner gets. Nothing beyond the label is editable from any panel, for a grantee or an owner: host, port, credentials and type are set once, at creation, and changing them after the fact is api-only either way.

Flow View and Control open the editor read-only. A grantee below Edit can open a shared flow and read every block, but cannot change or save it. Only Edit can save.

Flow Control and Flow Edit work as described. A grantee with Edit can change the blocks and the name; what the flow is attached to stays the owner's decision, and a grantee's attempt to change it is ignored rather than refused, so their ordinary save still goes through.

Anyone a flow is shared with can copy it. Duplicate flow in the editor's More actions menu offers Make my own copy at every level: a new, fully editable flow that belongs to the grantee alone, starts unattached and disabled, and survives even if you revoke their access. Share a flow only with people you are happy to give its blocks to.