docs(design): team collaboration PRD, RFCs, and research

[mmabrouk]

Why

Agenta mirrors Workspace members into Projects, and Project roles control access by resource type. Any member with view_sessions can read every session in the Project. The UI never shows that audience, and a user cannot start personal work and later share it with one colleague. That fits shared traces, evaluations, and testsets. It does not fit interactive agent sessions, which look like personal conversations.

This PR adds the design workspace for a team collaboration foundation. It is documentation only. No code changes, no implementation started.

What is in docs/design/team-collaboration/

• README.md indexes the set and defines the glossary (Workspace, Project, session access record, audience, grant, View vs Join). It states the design rule: no generic ACL framework yet.
• prd.md is the foundation PRD. Three tracks: authorization consistency, session audiences, session sharing.
• rfc-0-authorization-consistency.md fixes the current gaps first: Project mutations lack role checks, generic role assignment can grant Owner, member removal does not revoke personal API keys, and Viewer can decrypt secrets.
• rfc-1-session-audiences.md adds a server-filtered "My sessions" view, then personal vs Project audiences enforced through one session access record.
• rfc-2-session-sharing.md adds named read access, Project sharing, revocation, and owner lifecycle. Join, groups, and public links are out of scope.
• research.md compares three anonymized competitors with Agenta on sharing, visibility, roles, ownership, and governance, with a provisional Kano analysis.
• status.md tracks state and the open decisions.
• walkthrough.html is an interactive step-through of the research, the direction, and the three RFCs. Open it in a browser.

Status

Research and first PRD/RFC drafts are complete. Nothing is implemented. status.md lists seven product decisions that must be settled before implementation, and names the first safe slice: the server-filtered "My sessions" view, which ships without authorization changes.

Review wanted

Product direction and the seven decisions in status.md. Not the prose.

https://claude.ai/code/session_01UcHDEJ93d5idwAhMCTf4a4

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
agenta-documentation	Ready	Preview	Sep 14, 2026 9:58am UTC

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Mahmoud Mabrouk seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}