# Team sharing

Secrets can be shared with the people you work with — at the vault level,
never one secret at a time.

## How sharing works

- A **team vault** belongs to an org; its members see it according to their
  role
- Your **personal vault** is never shared — sharing a secret means putting
  it in a team vault
- Membership is managed from the org, not the vault: access follows the
  member list
- Each vault reports the caller's permission and an owner flag, and the API
  enforces them — owners manage the vault, members use what their role
  allows

## The audit trail

Every read of a shared secret lands in the
[activity log](/docs/secrets-mcp-integration) — what was used, when, and
through which surface. Shared credentials stay accountable: if a key needs
rotating, the log shows which access paths touched it.

## Coming soon

Finer per-member controls inside a single vault are still landing. Today a
member's reach is their org role.