# Access

These rules apply only when access checks are on for the team.

A deployed bot has three access levels. [Deployed Agents](https://cursor.com/dashboard/deployed-agents) shows Viewer, Editor,
and Owner. The API returns `viewer`, `deployer`, and `admin`. `admin` is
Owner. A write also accepts `owner` for that role, and `editor` for Editor.
The response value for Owner becomes `owner` in a later change, after
[Deployed Agents](https://cursor.com/dashboard/deployed-agents) shows `owner`.

| Dashboard | API value | What it allows |
| --- | --- | --- |
| Viewer | `viewer` | Open the bot |
| Editor | `deployer` | Deploy, stop, and restart |
| Owner | `admin` | Editor, plus secrets and who else has access |

A team Admin can manage every bot that team owns. The same person cannot
manage a bot another team published, including a catalog bot installed into
their team.

Today every member of the owning team has Owner access. Enforcement does not
remove deploy, secrets, or access management until that team grant is narrowed.