Owners and viewers

Ownership, viewing access, and membership answer different questions:

Concept	Question it answers
Owner	Which person or organization owns and manages this slate or resource?
Viewer	Who is using the hosted slate?
Resource mode	Does this use the slate Owner’s resource or the acting person’s resource?
Slate member	Who has completed setup and participates in member-scoped scheduled work?

Every slate, connected account, and shared secret has an Owner. These roles can overlap: the same person can own, view, and be a member of a slate. Opening a slate makes you a viewer; it does not itself make you a slate member or grant management access.

Owner

An Owner is a personal or organization identity. It has one of two types:

personal: a single user.
organization: an organization in ContextLayer. Every member of the organization can act for it.

A slate has exactly one Owner, chosen when the slate is created. By default, init selects you as its personal Owner. You can instead select an organization you belong to; see npx @usecontextlayer/cli init --help. The dashboard groups manageable slates under Personal and your organizations. Accounts and shared secrets belong to an Owner independently of any slate. A slate refers to them and never copies them, so one Owner’s accounts and secrets can serve several slates. See Accounts and Secrets. A personal Owner is managed by that user, and an organization Owner by the organization’s members. Managing an Owner covers its slates, its accounts and its secrets. Usage of a hosted slate is billed to the slate’s Owner.

Owner mode and viewer mode

Each declared resource has a mode that selects whose resource the hosted slate uses. This choice controls resource ownership, independently of the slate’s visibility:

Mode	Selected Owner	Effect
`owner`	The slate’s Owner	Viewers use the shared resource through the slate. Viewing alone gives no permission to manage that Owner’s accounts or secrets.
`viewer`	The personal Owner of the person a request or job acts for	Each person uses their own account, secret value, or database.

A browser request acts for its viewer. A hosted job has a run actor selected when it starts; Agents explains that selection.

public/slate.json

{
  "connections": {
    "work-email": {
      "toolkit": "gmail",
      "mode": "viewer"
    }
  },
  "databases": {
    "notes": {
      "mode": "owner"
    }
  }
}

In this example, notes is in owner mode, so viewers share the slate Owner’s database. work-email is in viewer mode, so each viewer assigns one of their own Gmail accounts to it. Two people can work with the same notes while fetching email from different inboxes. Viewer-mode resources work only on private slates. These mode rules describe hosted execution. During local development, connections use the signed-in developer’s personal accounts regardless of mode, secrets come from local environment variables, and databases use local storage. Resources explains that development boundary.

Viewers

A viewer is someone using the hosted app or accessing the slate through an MCP client. The slate’s visibility determines who is allowed to view it:

Slate	Who can view
Public	Anyone
Private, personal Owner	The owning user
Private, organization Owner	Members of the owning organization

The organization rule always uses the slate’s owning organization, regardless of which organization you have selected elsewhere. Public browser access does not require sign-in; MCP access still requires OAuth, even for public slates. Viewing access does not grant management.

Who can do what

Action	Who
Open the app and use its MCP tools	Viewers
Start agent jobs and read their results	Viewers of a private slate
Assign an account to a viewer-mode connection, or save a viewer-mode secret	Viewers, each for themselves
Assign an account to an owner-mode connection	The owning user, or members of the owning organization
Clone, pull, or push the source; see the slate in the dashboard	The owning user, or members of the owning organization, whatever the visibility
Read agent instructions, transcripts, and schedules; abort or delete jobs	The owning user, or members of the owning organization, whatever the visibility
Manage an Owner’s accounts and secrets	That user, or members of that organization

Slate members

A slate member is a person with a recorded relationship to that slate. Membership lets ContextLayer install scheduled work that acts for that person. It is separate from permission to open or manage the slate. A viewer of a private slate becomes a member automatically once the whole slate’s resource setup is complete for them:

Every connection declared by the app and its agents has an assigned account. A viewer-mode connection uses that person’s account; an owner-mode connection uses the slate Owner’s account.
Every viewer-mode secret declared by the app and its agents has a value supplied by that person.

ContextLayer checks for complete setup when a person saves a connection assignment, supplies a secret through the slate’s setup flow, or first uses a viewer-mode resource. Setting an Owner’s shared secret independently of a slate does not enroll someone in a slate. Once someone becomes a member, ContextLayer provisions and migrates their viewer-mode databases, then installs schedules for member-scoped agents. This happens in the background. The membership is already established while provisioning runs and remains established if provisioning fails.

Completed setup is the only way in; there is no explicit join.
Creating a slate does not make its creator a member.
Membership grants neither viewing nor management. It survives setup that later becomes incomplete.
Public slates never have members.

Slate membership is separate from organization membership. A member of an organization can view its private slates, and becomes a member of a slate only after completing that slate’s setup. Hosted slates run on contextlayer.xyz, a domain separate from usecontextlayer.com, where you sign in to ContextLayer itself. When a private slate needs you to sign in, it sends you to ContextLayer’s viewer sign-in. That flow identifies you with your ContextLayer account and returns you to the slate. The resulting viewer credential permits viewing and the runtime operations ContextLayer delegates for that slate. It grants no slate or Owner management authority, even if the same person can manage the slate through the dashboard or CLI with a separate management login. The slate’s own code never receives your credentials or your profile. ContextLayer verifies who you are and gives the app only capabilities bound to that slate and to you. The chrome, served from a ContextLayer origin, shows who you are signed in as.

Getting started

Core concepts

How-to

Reference

Owner

Owner mode and viewer mode

Viewers

Who can do what

Slate members

​Owner

​Owner mode and viewer mode

​Viewers

​Who can do what

​Slate members

​Viewer sign-in

Owner

Owner mode and viewer mode

Viewers

Who can do what

Slate members

Viewer sign-in