Permissions

A Knowledge Graph namespace is a Fontana Files namespace, and the grants on that namespace decide who reads and who edits it. You open the Knowledge Graph at /kg. A grant on the namespace is what lets you see it there. View knowledge graph (knowledge-graph:read) still applies to agent tools and MCP. The same grants apply to the Knowledge Graph page, chat context, and every MCP tool.

Namespace grants

Every Knowledge Graph namespace is a Fontana Files namespace tagged kg. The namespace’s grant list is the only Knowledge Graph permission: a person who holds a grant reads the whole namespace, and a person without one reads none of it. There is no narrowing inside a namespace, by folder, by file, or per agent. The Knowledge Graph ingests every file in a kg namespace, including skill and agent files when the namespace also holds those. To keep content apart, place it in a different namespace.

You manage grants where you manage every other namespace, in File System (/files): open the namespace menu and edit its grant list. Each grant names a subject and a level.

Grant levels

Level	What it allows
viewer	Search, automatic context, @-mentions, file reads through agent tools, and the KG Studio graph and file views.
editor	Everything a viewer can do, plus writes: the agent’s file update tool, the KG Studio editor, triple edits, and ontology edits.
admin	Everything an editor can do, plus managing the namespace itself and its grant list.

A grant change applies to the next search, tool call or KG Studio view within a few seconds.

Who can be granted

A grant subject is the whole tenant, a team, or a user. When several grants match you, the highest level wins: a viewer grant for the tenant and an editor grant for your team make you an editor. A files administrator reads every namespace.

Agents and namespaces

An agent carries a namespace allow-list on its Knowledge capability tile. On each turn it reads the namespaces on that list that you, the invoking user, may read:

• * on the allow-list means every namespace you may read.
• A named list is intersected with your grants, so an agent never reads a namespace on your behalf that you could not open yourself.
• Fontana-shipped agents with Knowledge Graph on carry *, and a new agent you create starts with * when you turn Knowledge Graph on.

An agent’s allow-list limits which namespaces it searches; your grants limit what it may read in them. In-app agents and external PAT clients both run under your identity, so the same rule applies to both.

Defaults for new and existing namespaces

A namespace you create in KG Studio starts with a tenant viewer grant, so everyone in your tenant can search it at once. Narrow it afterwards in File System by replacing the tenant grant with team or user grants.

Namespaces that existed before namespace grants became the Knowledge Graph permission received the same tenant viewer grant on upgrade, so search returns what it returned before. Review those namespaces and narrow the ones that hold restricted content.

Disabled content

Disabled files and folders stay out of every tool, search and automatic context, whatever the grants. See KG Studio for the Enabled / Disabled toggle.

Background processing

Ingest, extraction, ontology review and other background work that runs without a signed-in person reads as Fontana’s own service identity, which holds admin on every kg namespace. That work processes every namespace; what reaches a person or an agent is still decided by their grants.

Download links

A file you may read can be downloaded through a link the browser fetches directly from storage. Those links carry their own access:

• A link already issued keeps working until it expires, even if your grant on the namespace is removed afterwards.
• Links are issued only to people who hold a grant on the namespace at that moment, and only for that file.
• Treat a shared link like a copy of the file: to be certain nobody keeps access, replace or delete the file.

Related pages

• MCP: the tool catalog and how every call is checked against your grants.
• KG Studio: the namespace explorer, graph views and the Enabled / Disabled toggle.
• Fontana Files MCP: namespaces, grant levels and the tools that read and replace a grant list.
• Agents: the Knowledge capability tile and the namespace allow-list.