> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getthread.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Automagically: Client Access

> Restrict Automagically to a subset of your clients. Include or exclude clients by name or by PSA company type, and see how many clients a rule matches before you save.

Client Access controls which of your clients Automagically applies to. By default Automagically is available for every client in your workspace, but you can narrow the scope from **Admin → Automagically → Client Access**.

Use this when you want to pilot Automagically with a few clients before rolling it out, or when a small number of clients should be kept out of Automagically entirely.

> [!NOTE]
>
> Client Access is a workspace-wide rule. To limit which clients an individual
> member can see and act on, use the member's own client access setting in
> Admin Panel instead. See [Restrict a member's access to specific
> clients](https://docs.getthread.com/inbox/restrict-member-access-to-specific-clients.md). When both are
> set, a member can only reach clients allowed by both.

## What Client Access does

Client Access sets a workspace-wide rule. Once saved, clients outside the rule:

* Disappear from the Automagically client selector.
* Disappear from every runbook client picker, form field option list, and integration client list.
* Receive no runbook recommendations from Automagically or Super Magic.
* Are never offered runbook automations by the triage agent on their tickets. The agent skips those automations, triages the ticket normally, and escalates to a technician instead.
* Cannot be run against — direct execution, ticket-triggered runs, and agent-triggered runs all refuse the client with a `409` and an `excluded` client status.

Historical executions and reports for a now-excluded client stay visible. Client Access gates new activity, it does not remove past runs.

## Choose who Automagically applies to

The page has one setting with two top-level options:

* **All clients**: the default. Automagically is available for every active client in the workspace.
* **Only clients I choose**: Automagically is restricted to the clients you pick, using one of the two match modes below.

### Match modes

When you pick **Only clients I choose**, an **Automagically applies to** selector appears with two match modes:

* **only what I choose**: Automagically applies **only** to the clients and company types you choose. Every other client is out of scope. Use this to pilot Automagically with a short list of clients.
* **every client except what I choose**: Automagically applies to **every client except** the clients and company types you choose. Use this when almost every client should have Automagically and only a few should be kept out. New clients you add later are covered automatically.

Choose **every client except what I choose** for large tenants where an allowlist would be impractical. For a workspace with thousands of clients that only needs to exclude one, an exclude rule keeps the list short. Clients added in future also do not silently miss out on Automagically until someone remembers to add them.

### Clients and company types

Each rule can combine two kinds of selection under the same match mode:

* **Clients**: individual clients picked by name.
* **Company types**: PSA company types. The rule covers every client that has any of the types you pick.

A client matches the rule if you picked it by name or it has at least one of the picked company types. With **only what I choose**, matching clients are in scope. With **every client except what I choose**, matching clients are out of scope.

Company type rules are live. When a client gains or loses a picked type in your PSA, Automagically moves it in or out of scope after the next PSA sync. You do not need to save Client Access again. This also covers clients added to your PSA later.

Only company types ticked in **Global Inclusions** can be picked. If a type in a saved rule is later unticked in Global Inclusions, it shows as **(not in Global Inclusions)** with a warning icon. The type stays in the rule and is still enforced. You can remove it from the rule, but you cannot add it back until it is ticked in Global Inclusions again. If a type is deleted in your PSA, Automagically drops it from the rule because it no longer matches any client.

### Match count and save rules

While you edit the rule, the page shows how many active clients the rule matches, for example **12 clients match**. The count updates shortly after each change.

Automagically blocks saves that would not do what you intend:

* **Nothing chosen**: if you pick no clients and no company types, the page shows **Choose at least one client or company type** and **Save** is disabled. With **only what I choose**, an empty rule would switch Automagically off for the whole workspace. With **every client except what I choose**, an empty rule is the same as **All clients**, so switch back to **All clients** instead.
* **Include rule matches no clients**: if an **only what I choose** rule matches no active client, the page shows **No active client matches** and the save is refused. Choose a client or company type that active clients have, or switch to **every client except what I choose**.

A saved rule can stop reaching any client later, for example when a company type is removed from every client in your PSA. When that happens, the page shows **Automagically is off for every client** above the setting. Update the rule or switch to **All clients** to turn Automagically back on.

## Save the setting

1. In Automagically, open **Admin → Automagically → Client Access**.
2. Choose **All clients** or **Only clients I choose**.
3. If you chose **Only clients I choose**, pick a match mode, then select clients, company types, or both. Check the match count.
4. Click **Save**.

Changes apply to new activity immediately. Runs already in flight complete normally.

If a client you previously selected is later deactivated in your PSA, it stays in the list and you can remove it. You are not locked out of the setting because of a stale selection.

## Who can change this setting

Opening and saving the Client Access page requires an admin whose own client access covers every client. A member's client access comes from Thread: the **Client Access** card on the member's details page in Admin Panel, under **Members**. Automagically no longer keeps a separate per-member client scope.

An admin restricted to **Only specific clients** in Thread cannot open or save the page, because the setting reaches every client at once and a restricted admin could otherwise change access for clients outside their own set. This is stricter than the rest of Thread, where the admin role is exempt from client access scoping.

If RBAC permissions are on and every admin in your workspace is restricted to specific clients, nobody can open Client Access. Switch one admin to **All clients** on the members page to recover.

## What excluded clients see

For a technician working an excluded client's ticket, Automagically behaves as if the client is unavailable:

* The client does not appear in the Automagically client selector.
* Runbook recommendations are not generated for the client, and Super Magic will not propose a run or offer to build a new runbook against it.
* The triage agent does not offer runbook automations on the client's tickets. It checks Client Access before offering, so the client's contact is never asked questions for an automation that would be refused.
* If a client becomes excluded while the agent is already collecting answers for a runbook, the agent stops and hands the ticket to a technician. The handoff note records that the client is excluded by the workspace's Automagically client access.
* Attempting to run a runbook against the client from any surface — direct execution, the ticket runbook picker, or an agent tool call — is refused with an `excluded` client status.


## Related topics

- [Automagically security and compliance controls](https://docs.getthread.com/automagically/automagically-security-controls.md)
- [Restrict a member's access to specific clients](https://docs.getthread.com/inbox/restrict-member-access-to-specific-clients.md)
- [Client Access and how AI runs on tickets](https://docs.getthread.com/assistive-ai/client-access-and-run-paths.md)