Share a device with other people

Share in four steps

1. Create a team under Teams and invite members by email. Send them the invitation link yourself; no email is sent automatically.
2. The member signs in with a verified account and accepts. Opening the link alone changes nothing.
3. On Devices, choose Share for a device, pick the team or an external user, and select folders, tools and approvals.
4. In the team, set each member's device policy. Members start with no device access.

Open Teams · Open Sharing

Choose how shared work runs

Read only

Structured folder and file reads only. Revoking stops further calls.

Isolated execution

Each call runs in a temporary non-root Linux container with no network or host environment. Source is copied read-only and writes are discarded. Needs Linux Docker with seccomp and a digest-pinned image; it never falls back to the host.

Trusted host

Runs directly on the device. Must be enabled locally and confirmed per person. Revoking cannot undo changes already made.

adc-node roots add /path/to/project --label Collaboration
adc-node sharing on --isolation docker --image 'REGISTRY/IMAGE@sha256:DIGEST'
adc-node sharing off

Teams can share an exposed / or drive root with Connector 0.1.6+; isolated execution needs a smaller folder. External users always get specific folders.

From the CLI and SDK

adc team create --name Research
adc team invite TEAM_ID --email [email protected]
adc invitation accept INVITATION_ID --yes
adc team device-add TEAM_ID --node NODE_ID --scope scope.json
adc share create NODE_ID --email [email protected] --scope scope.json --days 7
adc share revoke BINDING_ID --yes

{
  "roots": [
    {
      "rootId": "root_EXACT_ID",
      "path": "/path/to/project",
      "writable": false
    }
  ],
  "allowedTools": [
    "file.list",
    "file.read",
    "file.search",
    "task.status",
    "task.wait"
  ],
  "execution": "read-only",
  "approvalPolicy": "always",
  "templateIds": []
}

Use --account TEAM_ID on management commands to act in a team. The SDK uses client.withAccount(teamId); HTTP uses the X-ADC-Account header. When creating Agent access for a shared device in the SDK, pass resourceBindings: [{ nodeId, bindingId }].

Revoking and approvals

• Changes apply to new calls immediately and to running work at its next lease renewal.
• Widening a share needs the recipient to accept again; existing Agent access never grows on its own.
• If both the requester and the device owner require approval, both must approve before the call runs.
• Members see only their own results. Device owners see what ran, not the requester's output.