Sharing and permissions

WriteMars is personal-first: your posts and your connected accounts are private until you decide otherwise. The team layer — shared calendars, company accounts, delegation — is something each member opts into, one switch at a time. The mental model is one sentence:

Anyone can write anywhere; whether it goes out depends on whether that account trusts you.

Workspace roles stay deliberately simple (Owner, Admin, Member). The real permission boundary is the connected social account — because the dangerous capability isn't editing a draft, it's posting as someone.

Post visibility

Every post is either:

Visibility	Who sees it
Private (default)	You, the owners of any account a variant targets, peer reviewers you invite, and whoever needs to approve it
On org calendar	Everyone in the workspace

Flip it from the Visibility control on the post detail page — or straight from an entry's peek popover on the Calendar. Two things to know:

• Scheduling a variant to a company account flips the post onto the org calendar automatically — company content is org content.
• An account's owner always sees posts queued to their account, even private ones. Nothing can be scheduled to your account behind your back.

Private posts show a small Private badge in lists, and are simply invisible elsewhere — to teammates and admins, in the app, the API, and MCP alike.

On org calendar is a real view, not just a flag. The Calendar has an Org scope that shows exactly the posts marked on the org calendar — the shared team plan — alongside Mine (your own work) and All. Scope decides which posts appear; it never changes what's revealed about a channel. A variant that publishes from a channel you can't see is redacted on the calendar wherever it appears: the card and popover show Private channel instead of the account, and its published URL is withheld. Redaction is per-channel and independent of scope — widening to the org calendar never unmasks a private account.

Account kinds

Company accounts

The brand accounts — usually a handful per workspace. An Admin marks an account as a Company account when connecting it (or its owner converts it later from Settings -> Channels). Company accounts are run by the org:

• All Admins and the Owner publish directly, approve requests, and manage the account's settings.
• Every member can see it and propose posts to it — proposals wait in the approvals queue until an Admin signs off.

Personal accounts

Everything else. A personal account is invisible to the rest of the workspace until its owner shares it, and admins get no special powers over it. The owner controls these settings in the account's menu under Settings -> Channels -> Manage sharing:

Switch	What it grants
Admins can draft posts for this account	Admins can schedule posts from your account, but what they schedule routes to you for approval. This is the agency / founder-delegation mode: hand your account to the marketing team while keeping the final say.
Admins can engage as this account	Admins can use your account as an engagement profile on team posts — auto-likes, comments, reposts.
Convert to company account	Hands the channel to the workspace. Admins run it, members can propose posts to it, and the account becomes visible as a company channel.

Trusted members

Each account also has a Trusted members list. Trusting someone is full delegation for content:

• They publish to the account directly — no approval.
• They can approve other people's requests to that account, acting on your behalf.

Trust someone you work with daily (your ghostwriter, your marketing lead); leave everyone else behind the approval gate.

Who can do what

For an account C and a member:

Action on C	Member	Trusted on C	Admin	Owner of C
Schedule to a private personal account	—	✓ direct	—	✓ direct
Schedule to a managed personal account	—	✓ direct	✓ → owner approves	✓ direct
Schedule to a company account	✓ → admin approves	✓ direct	✓ direct	—
Approve/reject requests for C	—	✓	company only	✓
Use C for auto-engagement	—	✓	company or team-engagement only	✓
Change C's sharing switches and trusted list	—	—	company only	✓
See C's activity feed	—	—	company only	✓

A few consequences worth spelling out:

• Members never hit a wall. Scheduling to an account you can't publish directly doesn't error — the post is held as Awaiting approval and the right people are notified. See Approvals.
• Revoking is retroactive. Remove someone's trust (or turn off a sharing switch) and their already-scheduled posts re-route to approval at publish time instead of going out; their pending engagement rules stop with an authorization error.
• There are no side doors. The same checks run server-side for the app, the REST API, personal access tokens, and AI agents over MCP. An agent told to "publish now" on a gated account gets the post routed to approvers, same as a person.
• Usage is visible to channel managers. Manage sharing shows today's post and engagement counts for the account, with caps when one applies.

The account activity feed

Lending your account only works if you can see what's done with it. Every account has an Activity view (in its menu under Settings -> Channels) listing, newest first:

• posts scheduled and published through the account — including who queued them and who approved them, even when the scheduler did the actual publishing;
• engagement actions performed as the account, and any that failed;
• approval requests and their resolutions;
• trust grants and revocations, and every change to the sharing switches.

The feed is visible to the account's owner — and to Admins for company accounts.

Defaults at a glance

Fresh out of the box, with zero configuration:

• New posts are private.
• Newly connected accounts are personal and invisible to the team.
• Nothing can publish to an account except its owner.

Which means a brand-new workspace is already safe for both the solo user jotting ideas and the 50-person company — openness is opt-in, never the default.