CoachDiscoverMapCompareSavedAI LearningAI WeeklyAbout
← Library
02 · Applied

Permissions & Persona Access

SharePoint already knows who can do what. Use that to stop the AI from offering skills your users can't actually run.

Takeaway 1
SharePoint permissions already segment users into personas — owners, members, visitors.
Takeaway 2
Skills inherit that model. You can scope a skill to one persona or to a custom group.
Takeaway 3
Hiding skills users can't run keeps the AI from offering them — fewer dead ends, sharper answers.

Why Permissions Belong in Skill Design

SharePoint sites already know who is allowed to do what. A skill that updates payroll only makes sense for HR. A skill that deletes archived files only makes sense for owners. If you leave every skill open to every user, the AI will happily suggest a skill the caller has no rights to actually execute — and the run fails halfway through.

Wire SharePoint's existing permission model into your skills. Don't let the AI suggest a skill the current user can't complete.

The author's phrasing in the video: "Don't let users try to execute skills that won't actually work for them." Permissions are a first-class context signal — they tell the agent which moves are even legal for this person.

The Skills Library

The Skills Library is the per-site catalogue of every skill installed in that SharePoint site. Open it and you see a list of skills with their triggers, descriptions, and — crucially — a permission column. Click any skill to manage who can use it, who can edit it, and who can't see it at all.

The Skills Library is also a permission console. Selecting a skill row lets you change persona access in seconds — no policy file, no admin portal.

This is where you go to lock down sensitive skills, audit who is using what, or push a permission change after you've added a new skill. The same UI handles install and access.

Admin-Only Skills

An admin-only skill is one whose persona access has been narrowed so only site owners (or another designated group) can call it. In the demo the author creates a skill named "admin only," opens the Skills Library, finds the skill, and removes visitor access — visitors can no longer see or trigger it.

Restricting a skill does more than enforce security. It hides the skill from the AI's menu for that user, so the model never even proposes it.

Use this pattern for destructive actions, finance flows, hiring workflows, or anything where a wrong person triggering the skill would cause damage. The skill still lives in the library — it's just invisible to the wrong audience.

"If I just don't mention the skill, users won't find it." Wrong — the AI surfaces installed skills proactively when an utterance matches. You have to mark the skill as inaccessible for that persona; mere obscurity isn't enough.

Default Persona Behavior

Out of the box, visitors can leverage skills the owner has built but can't edit them. Members can edit. Owners have full control. You can override any of these per-skill — visitor read-only is a default, not a ceiling.

Always ask: "Should every persona who can use this site also be able to run this skill?" If the answer is no — even for one persona — open the skill in the Skills Library and tighten its access before publishing.

Default permissions are convenient, not correct. Review them per skill at publish time so the AI's menu matches each user's authority.
Flashcards — Applied
02 · Applied
Skills Library
tap to reveal →
The per-site catalogue of installed skills. Open it to inspect, edit, or change persona access for any skill on the SharePoint site.
← tap to flip back
02 · Applied
Persona Access
tap to reveal →
Per-skill setting that controls which SharePoint personas — owners, members, visitors, or custom groups — can see and run the skill.
← tap to flip back
02 · Applied
Admin-Only Skill
tap to reveal →
A skill whose persona access has been narrowed so only owners (or another designated group) can see or invoke it. Other users never see it offered.
← tap to flip back
02 · Applied
Visitor Default
tap to reveal →
By default, visitors can leverage skills but cannot edit them. Owners can override this either way per skill.
← tap to flip back