Service account

A service account is an account that is independent of any user. Like a user, it can have a workspace role, belong to groups, and be granted permissions on resources. You can also run routines with a service account's permissions. Switching to a service account to act as it is in preview.

Service account permissions

What a service account can do depends on its workspace role, the groups it belongs to, and the permissions granted to it on each resource.

• The workspace role can be Editor or Viewer. In workspaces where custom roles are available, you can also choose a custom role. A service account can't be an Owner or a Guest.
• You add the service account to groups with Add to groups in the list's menu, and remove it with the × next to the group name in the Groups column of the list. You can also add and remove it in Group settings > Group members in Groups.
• A service account can also be a Group Owner. As a Group Owner, it can edit the group, manage its members, and inherits the permissions granted to the group.
• In the sharing and permission settings of each resource, any user who can change those settings can select a service account and grant it permissions in the same way as a user.

Admins and users

Admins and users shows who can manage the service account (Workspace Owners, fixed) and manages which users and groups can use it. Changing the users requires the member management permission (Workspace Owners and users whose role has the Members permission).

Target	Description
Workspace owners	Always included as Admin (fixed)
Group / individual members	Add from Add group or member. The role is User

• Admin: can edit and delete the service account, and manage its admins and users. Only Workspace Owners are admins. Users with the member management permission can also edit and delete the service account and manage its users.
• User: can set the service account as a routine's run permission and operate the service account's sessions. Users can also switch to the service account.

Creating and managing service accounts

Creating and managing service accounts requires the member management permission.

1. Open the global nav > Workspace settings > Service Accounts.
2. Select Create service account and specify Name / Workspace role.
3. Add the users or groups that will use the service account to Admins and users.

To add the service account to groups, use Add to groups in the list's menu after you create it.

To edit or delete a service account after you create it, use the menu on each row of the list (Management menu actions).

Management menu actions

The menu on each row of the list has the following actions.

Action	Description
Edit	Changes the name, workspace role, and admins and users.
Add to groups	Adds the service account to groups.
Delete	You can't undo a deletion. The service account's Private folder (including the notebooks and folders within it) is also deleted, including items created by users who switched to it.

When you delete a service account, runs of routines whose run permission is that service account fail.

AI agent sessions

All users of a service account, including Workspace Owners, can view and operate the AI agent sessions that run with that service account's permissions, even if the sessions aren't shared. These include sessions run by routines whose run permission is the service account, and sessions started while switched to the service account.

• You can open a session and continue it from your own account without switching. Instructions you give from your own account also run with the service account's permissions.
• This session runs with the permissions of the service account "(service account name)". appears at the top of the session. Whoever continues the session, the AI agent runs with the service account's permissions.
• When you continue a session from your own account, browser tools, such as running or saving notebooks, aren't available. To use them, switch to the service account and then send your instruction.
• Any user of the service account can approve or reject actions that need confirmation.
• These sessions don't appear in the session list of your own account. Open them from a routine's Run history or from a shared link.
• While switched, you can filter the session list with Started by me. It's on by default, so only the sessions you started are shown.

Switching to a service account Preview

INFO

This feature is in preview. To request access, contact Codatum support.

When you switch to a service account, you act as that service account. Your actions use the service account's permissions, not your own, and notebooks and other resources you create belong to the service account.

1. Open the avatar icon at the bottom of the global nav > Switch to service account.
2. Select the service account to switch to.

After you switch, the workspace top page opens, and the avatar icon and name change to those of the service account.

You can also connect an MCP client as a service account that you can switch to.

Returning to your account

1. Select the avatar icon at the bottom of the global nav > Return to my account.

Who can switch

Users added as users and Workspace Owners (admins) can switch to the service account. If there's no service account you can switch to, Switch to service account isn't shown in the avatar icon menu.

• If you add a group, users who are added to that group later can also switch.
• A Workspace Owner can switch without being added as a user.
• Workspace guests can't switch, even if they're added as users.

Scope of a switch

A switch applies to the browser tab where you switched. It carries over to new tabs opened from that tab (for example, from quick search) and to duplicated tabs. Other tabs stay on your account.

Records of actions while switched

Resources such as notebooks that you create or update while switched are treated as created or updated by the service account. The audit log also records these actions as actions of the service account.

Comments and reactions are shown as posted by the user who switched, not by the service account.

Information shared among users who can switch

Information tied to a service account is shared by all users who can switch to it.

• The Private folder is available to service accounts whose workspace role is Editor or a custom role with the Private notebooks permission, and all users who can switch can access it. While switched, it shows Users who can switch to this service account have access.
• Stars, recently viewed items, and the Created by me tab of notebooks are per service account.
• AI agent pins, memory, and settings are per service account. However, User Preferences (Language and Enter to newline) in the settings are those of the user who is operating.

Features unavailable while switched

The following features are tied to the individual user, so they're hidden or unavailable while switched.

Feature	Description
Account settings	Account settings, theme switching, and language switching in the avatar menu are hidden.
Workspace settings	When you open them, you're asked to return to your account.
Other workspaces	You can only open the workspace where you switched. You also can't accept workspace invitations.
Notifications	Notifications are hidden.
Workflows	Workflow pages are hidden. The AI agent doesn't operate workflows either.
Guest invitations from reports	Inviting guests on a report is hidden. You can't invite guests, view invited guests, or remove their permissions.
Connector authentication	You can't connect personal-authentication connectors.
AI agent feedback	Send feedback is hidden.

Applying removal from users and deletion

After you do any of the following, a user who is currently switched might still be able to act as the service account for up to 1 hour (Limits).

• Remove the user from the service account's users.
• Delete the service account.

The same applies to the service account's sessions that a user continues from their own account.

However, an open notebook editing screen might let you keep editing beyond 1 hour while it stays open.

If the service account is shown as unavailable

Service Account is unavailable is shown in any of the following cases.

• You were removed from the service account's users.
• Your workspace role was changed to Guest.
• You were a Workspace Owner who wasn't added as a user, and your workspace role was changed from Owner.
• The service account was deleted.
• The service account lost access to the workspace.

1. Select Return to my account.
2. To switch again, ask a Workspace Owner to check the service account's status and admins and users.