Connection scopes

A connection’s scope decides which agents can use it. Connect an account at the broadest scope that makes sense, and you won’t need to connect it again for each agent.

The four scopes

Pick the level that matches who should use the account:

Organization — every team, project, and agent. Use it for shared accounts such as a company GitHub organization.
Team — one team and everything in it. Use it for tools that team owns.
Project — one project. Use it for an account tied to that work.
Agent — one agent only. Use it for an account that shouldn’t be shared.

How inheritance works

Connections flow down the hierarchy:

An organization connection reaches every team, project, and agent.
A team connection reaches that team’s projects and agents.
A project connection reaches that project’s agents.

Each scope’s Connections view lists its own connections and its inherited ones. An inherited row shows an Inherited from badge and is read-only there. Select Manage at source scope to change it where it lives.

When a provider is connected more than once

An agent can see every account in its scope chain. Agents that work with several accounts, such as GitHub or Google Workspace, can choose among them. If the agent asks for credentials without naming an account, Alfe picks the most specific scope first: agent, then project or team, then organization. If two connections tie, the newest one wins.

So you can set a shared default for your organization, then override it for one agent by connecting a different account there.

Providers limited to agent scope

Some connections always belong to one agent, because they represent that agent’s own identity or funds:

Mobile number
Crypto wallet
Telegram

Channels are also agent-only. See Channels.

Move a connection

Moving keeps the same connection, so you don’t authorize it again and anything already using it keeps working. Only its availability changes.

Open the Connections view for the scope that owns the connection.
Select Move on the connection.
Pick the new scope.

The picker lists your organization, top-level teams and projects, and agents where you can manage connections.

You can’t move these connections:

Mobile numbers — release the number and buy one for the other agent.
Crypto wallets — export or disconnect the wallet, then create it for the other agent.
AWS SSO and shared sessions — sign in or share again at the new scope.

Choose a scope

Use these rules of thumb:

Shared by everyone: organization.
Owned by one team or project: team or project.
Sensitive, or belongs to one agent: agent.

If an account can spend money or change production systems, start narrow. It’s safer to widen access later than to discover every agent had it.