Solutions
Most tools treat access as a billing lever — pay more, unlock more buttons. untactit treats it as a workflow. Four roles, each with exactly the capabilities that role needs, enforced on the server.
Every capability below is checked server-side on each request. The interface reflects the decision — it never makes one.
| Capability | Admin | Approver | Editor | Viewer |
|---|---|---|---|---|
Browse and load assets Company layer |
✓ | ✓ | ✓ | ✓ |
Create in personal layer Drafts and experiments |
✓ | ✓ | ✓ | — |
Propose to company layer Triggers review |
✓ | ✓ | ✓ | — |
Approve or reject Gate to production |
✓ | ✓ | — | — |
Deploy to platforms Push to machines |
✓ | ✓ | — | — |
Assign roles Grant and revoke |
✓ | — | — | — |
Manage domains and SSO Workspace identity |
✓ | — | — | — |
Read full audit log All actions, all people |
✓ | ✓ | — | — |
Viewers are unlimited and free on Team and Enterprise. You only pay for people who create or approve.
For admins
Full inventory across every vendor and every person. Grant roles, manage verified domains, read the complete audit trail. Nothing reaches the company layer without passing through a review you configured.
A day as admin
Three machines are running an older version of the sales handler. One click re-syncs them.
They sign in with SSO, get the Viewer role by domain rule, and load 40 approved assets instantly.
"What can our agents see?" — one audit query, exported as CSV, done in two minutes.
The review queue
For approvers
Every change bound for the company layer waits in your queue. Compare the diff line by line, leave a note, approve or send it back. Your decision is written to the audit log permanently — including the reasoning.
For editors
No new editor, no new workflow. Keep authoring assets in Claude, Cursor, or wherever you work today. untactit syncs them into your personal layer. When something is worth sharing, you propose it — and your name stays on it through approval and deployment.
Editor workflow
untactit reads the folder. Nothing changes about how you work.
Every save is a version. Roll back anytime. Nobody else sees it yet.
One click sends it to an approver. You keep authorship forever.
What viewers get
For viewers
Most people in an organization consume agent assets rather than author them. They should not be a line item. Viewers load approved assets into any connected tool, always get the canonical version, and cost nothing on paid plans.
No. Each person has exactly one role per workspace. If you need an approver who also administers the workspace, give them Admin — it includes every approver capability.
Their personal layer is archived, but everything they promoted to the company layer stays, with their name still on it. That is the entire point — knowledge outlives tenure.
Multi-step approval chains are available on Enterprise. You define which asset types or layers require more than one signature.
With SCIM on Enterprise, yes — group membership maps to roles and deprovisioning is automatic. On Team, roles are managed in untactit and sign-in comes from your IdP.
Connect one workspace and see every skill, rule, and memory your team has in play — in about ten minutes.
No credit card. Works with what you already run.