Skip to main content
By default, every member of your workspace can see every client. Client access scoping lets you change that for co-managed clients, pod structures, or contractors: you restrict a member to a specific set of client companies, and Thread filters what they see to match. Use this page to create access groups, scope individual members, and understand the limits that apply.

​
How client access works

Each member has one of two client access modes:
  • All clients: the default. The member sees every client company in the workspace.
  • Only specific clients: the member sees only the client companies you assign to them, either as individual picks or through access groups. Their effective access is the combined set of both.
When a member is restricted to specific clients, Thread filters Inbox lists and thread detail to those clients. Tickets, client companies, and contacts outside their assigned set don’t appear for them. Tickets with no client company are also hidden from scoped members, and opening one directly behaves like any other out-of-scope ticket. Unmapped IT Glue organizations are hidden from them too. Voice calls follow the same rule: a scoped member sees a call, including its recording and transcript, only when they can see its ticket, or its contact when the call has no ticket. Calls with neither a ticket nor a contact are hidden from them. Thread MCP tools that a scoped member uses through an OAuth app or an MCP key are limited to the same clients. Thread also skips notifications for tickets outside their assigned set, so a scoped member isn’t notified about new tickets, replies, notes, mentions, or assignments on clients they can’t see. Notifications a member received before their access was narrowed stay in their notification list.
To make sure tickets with no client still get handled, map them to a client company or have a member on All clients work them.

​
Tickets with no client

A ticket that isn’t attached to any client company is visible only to admins and to members on All clients. A member on Only specific clients doesn’t see it anywhere, including Inbox lists, search, counts, and notifications, and opening a direct link to it shows the same “not found” as any other ticket outside their access. This means a scoped member won’t see unmapped tickets waiting in a catch-all or triage queue. If a scoped member handles triage, either move them to All clients or make sure incoming tickets are matched to a client before they reach that member. Tickets raised against your own company (internal tickets) are not affected and stay visible to every member. Two things scoping never changes:
  • Admins are exempt. A member with the admin role always sees every client, regardless of any access settings.
  • A member assigned no clients sees no clients. Switching a member to Only specific clients without assigning anything leaves them with an empty view, not a fallback to everything.

​
Create an access group

An access group is a reusable, named set of client companies. Build one per pod, region, or contract, then assign it to as many members as you need instead of picking the same clients member by member.
1

Open Access Groups

In Admin Panel, go to Members and open the Access Groups tab.
2

Create the group

Select Create access group and name it.
3

Add clients

Add the client companies the group should grant access to. You can search the client list and pick clients individually, or use Add by type to add every active client of one or more company types at once. Each type shows how many clients it would add to the group. When Type Inclusion is on, only included types are listed. Adding by type counts toward the same 1,000-client limit.
4

Assign members

Assign the members who should receive this set of clients. You can also assign groups later from each member’s details page.
Editing a group updates access for every member assigned to it, so a new client added to the group becomes visible to all of those members at once.

​
Restrict an individual member

1

Open the member

In Admin Panel, go to Members and select the member to open Member Details.
2

Choose the access mode

In the Client Access card, switch the member from All clients to Only specific clients.
3

Assign clients

Pick individual client companies, assign one or more access groups, or combine both. The member’s effective access is the union of everything assigned.

​
The total client limit

A member in Only specific clients mode can have at most 1,000 client companies in their effective access. The count is the deduplicated union of their direct picks and every client in every access group they’re assigned. Admin Panel enforces the limit whenever a save would push a member over it:
  • Saving a member’s client access shows a warning with the member’s projected client count, and the change isn’t saved.
  • Adding clients to an access group warns and lists each assigned member the change would push over the limit. No clients are added.
  • Assigning members to an access group warns and lists the members who can’t be assigned. Nobody is assigned.
A member who genuinely needs access to more than 1,000 clients should use the All clients mode instead.
Client access scoping is separate from the Client Access lists on individual Magic AI features, which control where assistive AI runs rather than what a member can see. See Client Access and how AI runs on tickets for that feature.