Move a trusted file to your second workspace
Share the selected file to your own account, switch workspace, and add a private copy without recreating the file or blending the two workspaces.
Private Resource Sharing
Share a single Drive file, Drive document, or CRM contact without opening your whole workspace. Choose who can view, comment, or edit it, including a named person in a completely different Sistava workspace, and revoke that access at any time.
Your workspace is private by default. Bring teammates in with a workspace role, Owner, Admin, or Collaborator, when they need to work alongside you day to day, then use Private Resource Sharing only when a single item, a Drive file, a Drive document, or a CRM contact, needs a narrower audience than your whole roster.
A direct share is an authenticated offer, not a public URL. The recipient signs in to see that one item and never becomes a member of your workspace or gains access to your other employees, conversations, files, contacts, billing, or settings.
The two systems intentionally do not overlap. Workspace membership is ongoing and broad: an Owner or Admin can grant a Collaborator the extra ability to invite people or manage resource access, but that still operates at the workspace level. A resource grant is narrow and typed: Viewer for read-only, Commenter for read plus comments, or Editor for full read-write, on exactly one file, document, or contact, with an optional expiry date after which the grant simply stops counting, no separate revoke step required.
If you run two workspaces, or work with a partner who uses another one, the recipient can explicitly add a private copy to their chosen workspace. Nothing appears there until they accept. The new copy is independent, so your source workspace stays isolated.
Remove the source share whenever the collaboration ends. The recipient immediately loses the protected source view and cannot import it later. A copy they already accepted remains theirs, just as a file sent to a collaborator would.
Invite a Teammate or Share One Item
Workspace membership is for ongoing collaboration. Owners, Admins, and Collaborators each receive a clear level of operational access, and Owners can grant a non-Owner a limited exception such as inviting people or managing resource access.
Resource Access is for the exception. Use it when a customer, contractor, partner, or second workspace needs a selected report or contact but does not need to enter the source workspace.
No Public Links, No Accidental Exposure
Shared resources stay behind sign-in and server-enforced access checks. Copying a link into email or chat is convenient, but it never creates permission for someone who was not granted access.
Public anonymous links are intentionally unavailable. Every direct recipient is known, every source grant can be removed, and every imported copy is created only after the receiving workspace chooses it.
What's Covered Today, What Isn't
Only three resource types carry a policy right now: Drive assets, Drive documents, and CRM contacts. The check runs at every read and write path for each one, GraphQL listings, the file's byte proxy, comment threads, and the edit or delete mutation, so a copied internal link cannot bypass it.
Tasks, calendar events, and other work items keep their current workspace-only behavior until they get their own sharing control. Private Resource Sharing is included on every plan, with no seat limit or added cost on top of it.
How It Works
One access policy per resource, checked before every view, comment, or edit
Every Drive file, Drive document, and CRM contact starts with no access policy, which means it follows the workspace's normal collaborator rules. The moment an owner or admin restricts it or shares it with someone by name, the platform creates a policy row for that specific resource and starts checking it on every open, comment, and edit request.
A policy can stay Restricted (only the owner, admins, and people with an explicit grant can reach it) or Organization (any workspace collaborator can reach it, same as before). Each grant carries a role: Viewer for read-only, Commenter for read plus comments, Editor for full read-write, plus an optional expiry date after which the grant simply stops counting.
A cross-workspace grant works differently on purpose. The recipient does not become a member of your workspace and cannot see anything else in it. They land on a dedicated shared-item page, and if they choose to import it, the platform copies the file, document, or contact record into a workspace they already belong to. From that point it is their own independent copy: revoking your original share no longer affects it.
Use Cases
Send one CRM contact to a partner
Give a partner a protected offer for one contact without exposing the rest of your CRM or inviting them to your workspace.
Keep a sensitive report restricted
Limit a file to named people while the rest of your accepted workspace members keep their normal access to ordinary work.
Give a contractor time-boxed access
Grant Viewer or Editor access with an expiry date so the contractor's access stops counting automatically at project end, with no separate revoke step to remember.
FAQ
Can a shared file be opened by anyone with the link?
No. Links stay private. The recipient must sign in to the account that received the direct share and pass the resource access check.
Can I share between two workspaces I own?
Yes. Share the selected supported resource to your own account, switch to the destination workspace, and accept it as a new private copy.
What can I share today?
Resource Access supports Drive files, Drive documents, and CRM contacts. Other resource types keep their workspace boundaries until they receive their own sharing control.
What happens when I revoke a direct share?
The recipient loses access to the source item immediately and cannot import it later. A separate copy they already accepted remains in their workspace.
What roles can I grant, and can access expire on its own?
Viewer for read-only, Commenter for read plus comments, or Editor for full read-write. Every grant can also carry an expiry date, after which it simply stops counting, so you do not have to remember to revoke it yourself.
Does this cost extra or need a specific plan?
No. Private Resource Sharing is available on every plan at no added cost, with no cap on how many resources or people you share with.
Where Private Resource Sharing fits
Private Resource Sharing is part of Where their work lives.
Your AI agents manage their own workspace. Scheduled tasks run daily, weekly, or on custom cron cadences. A built-in kanban board tracks what is in progress. Every document lands in a personal Drive. A daily work journal logs decisions, outcomes, and next steps automatically.
- Where their work lives: Where your employees organize their work.
Read the guide
More in Workspace
- Move a Team Member to the Bench: Every workspace has one Bench: a holding area for employees who are not currently on a working team. Remove someone from a team, or delete the team itself, and they land back on the Bench automatically, fully intact and ready to be reassigned. Nothing about them is deleted; only their team membership changes.
- Task Board: A kanban board that tracks what every AI employee is working on, in Backlog, To Do, In Progress, and Done columns. Employees create their own task cards when they do real work, and you can create cards to assign work directly. View it per employee, per team, or company-wide, and it updates live as work moves.
- Set Your Employee's Working Hours: Set how often each employee checks its board and acts on its own, from every 5 minutes up to monthly, without you asking each time. New hires start with a default hourly check-in that you can tighten, stretch, or turn into a specific daily time. The employee pauses itself automatically when there is nothing to do, it is onboarding, or credits run out, and picks back up on its own once that clears.
- Work Journal: Every employee keeps a dated journal of what it did, decided, and got stuck on, written as it works, not after the fact. Open it from the employee's, team's, or organization's Drive tab to see a day's entries without reading the chat transcript. Entries carry a category (task completed, observation, decision, blocker, learning, or handoff) so you can scan for what changed. It starts on hire with nothing to configure.
- Task Comments: Comment directly on a task, Drive file, sprint, CRM contact, or notification, and @mention the person, team, or AI employee who should act on it. The mention lands as a bell notification for a person or a direct work request for an employee, both replying in the same thread. Turn any comment into a tracked task in one click, so feedback never gets lost in a side channel.
- CRM: Every business runs on a CRM, the shared book of the people and companies it deals with. Sistava builds one in, and your AI employees run it for you. They add a prospect the moment one comes up, keep contacts current, open deals and move them down the pipeline as they progress, and write notes so nothing is forgotten. You get one clean place to see who you know, what's in flight, and what it's worth, without paying for a separate CRM.
- Sales Pipeline: Your deals live on a pipeline board, the same shape as your task board: a column for every stage, New, Screening, Meeting, Proposal, Customer, and a card for each deal showing its value and the company behind it. As a deal gets closer to won, it moves down the board. Your AI employees keep the pipeline current, opening deals, moving stages, and updating amounts, so you always know what's in flight and what it's worth, at a glance.
- Let Your Employee Use Any Desktop App: Your employee controls your actual desktop, not just a browser tab. It clicks, types, manages files, and runs terminal commands in real applications on your machine, the same way you would sitting at the keyboard. It works through the free Desktop Companion app and covers native software, file management, and shell tasks in one capability.
- Let Your Employee Work with Local Files: Connect the Desktop Companion app and your employee can read, write, list, and search files on your own computer, scoped to your home directory. Ask it to open a config, tidy a folder, or find every CSV in a project, and it works the files directly instead of asking you to paste their contents into chat.
- Let Your Employee Run Terminal Commands: Once you pair the Sista desktop app, your employee can run real shell commands on your machine: git, npm, brew, ls, grep, and anything else you'd type yourself. Commands run as your own user with no privilege escalation, and a hard-coded blocklist rejects destructive patterns like rm -rf /, disk formatting, or piping a remote script into a shell before they ever execute.
- Let Your Employee See Your Screen: Your employee looks at your actual screen and works from what it sees, not just an API. It captures your desktop through the Sista desktop app, reads the pixels the same way you would, and can click, type, and scroll based on what it finds. That covers any app you have open, including native software, dashboards, and design tools that never had an integration.
- Employee Drive: Every document, generated image, video, screenshot, and daily work log an employee produces lands automatically in its Drive, no saving required. Browse it per employee, per team, or company-wide, as a searchable flat grid or as folders. Files preview inline, from PDFs and spreadsheets to code and video, so you rarely need to download something just to read it. Every update becomes a numbered version that you can preview or restore without losing the original file.