Skip to main content
Artifact links require authentication to your Runlayer organization. Recipients also need permission to view the artifact; copying a link does not grant access.

​
Share an artifact

  1. Open the artifact and select Share.
  2. Add people, groups, teams, or roles from your organization.
  3. Choose the appropriate permission, then copy the link from the sharing panel.
Replacing or editing file content through Runlayer MCP still requires ownership of the standalone artifact. See Create and update. Under General access, owners and admins can choose Everyone at [organization name] to share with the organization, or Only people invited to limit direct access to invited recipients. Organization-wide access still requires sign-in. Give an artifact a readable address such as https://<your-runlayer-host>/artifacts/kpi-dashboard. Open the artifact, select ⋯ → Custom link, and type a name. Letters are lowercased and spaces or symbols become hyphens, so “KPI Dashboard” saves as kpi-dashboard. Assistants and agents can set one through Runlayer MCP with set_artifact_alias; it accepts only lowercase letters, numbers, and single hyphens.
  • Each custom link is unique within your organization.
  • The artifact’s original link keeps working, and Copy link in the sharing panel hands out the custom link.
  • A custom link grants no access: recipients still need permission to view the artifact.
  • Renaming or removing a custom link frees the old address. Links that used it no longer open this artifact, and they open another artifact if someone later gives it that custom link.

​
Access inherited from an agent

For agent-created artifacts, the originating agent’s Artifact sharing setting also grants access. Open Artifact sharing settings on the agent’s detail page to review it. The artifact creator retains ownership, and administrators with Manage Agents can manage artifacts. Direct artifact shares can grant access in addition to the agent’s setting.
Access is cumulative. Removing a direct invitation does not revoke access someone still has through a group, team, role, organization-wide share, or the originating agent. Review those sources when restricting an artifact.
An artifact your own assistant creates through Runlayer MCP has no originating agent, so its access does not inherit an agent’s sharing setting. When a Runlayer Agent creates an artifact through Runlayer MCP, that agent is the originating agent.

​
Keep artifacts inside a team

Workspace admins can’t block org-wide artifact sharing. An artifact’s owner can choose Everyone at [organization name], and anyone with Can edit on it can invite people from other teams. To keep a team’s artifacts with that team:
  1. Artifacts made by an agent: open the agent’s Artifact sharing settings and choose Everyone with access to this agent. Share the agent with the team only, and keep its General access on Only people invited. The default setting, Anyone in your organization with the link, lets anyone in the workspace open the agent’s artifacts.
  2. Other artifacts (for example, ones your assistant publishes through Runlayer MCP): a team owner adds each one to the team (Add on the team page), and its General access stays on Only people invited.
  3. Give the team Can use on the agent and on its artifacts (the team’s Default access to assets). Members with Can use can open and download artifacts but can’t share them. Can edit lets them invite anyone in the workspace.
The artifact’s owner and the agent’s owner can still share outside the team, and administrators with Manage Agents can manage every artifact. New shares show up in the audit log as resource_shared, so you can review artifacts shared outside a team.

​
Sharing outside your organization

Artifact sharing supports authenticated members of your Runlayer organization. To show an artifact to someone outside it, your organization can enable public links.
A public link needs no sign-in. Anyone who has it, including people it is forwarded to, can open the artifact and read everything in it. Only make an artifact public if its content could be posted on the open internet.
When public links are enabled for your organization, the artifact’s owner (or an administrator with Manage Agents) can open ⋯ → Make public…, confirm the warning, and copy the link. A red Public badge then shows next to the artifact’s actions.
  • A link opens the artifact at most 5 times, then stops working. Every load counts, including reloads, link previews in chat apps, and email link scanners. Select the Public badge to see how many opens are left.
  • Links expire 30 days after they are turned on, even with opens left. To keep sharing, turn the link off and on again; that creates a new link with a new expiry and 5 new opens.
  • Select the Public badge and Turn off public link to stop it working immediately. Turning it on again creates a new link; the old one stays dead. You can always turn a link off, even after your organization turns the feature off.
  • Only people with Full access can see and copy the link. Everyone else who can open the artifact sees the Public badge but not the link.
  • The link is paused while the artifact’s creator or the person who turned it on is deactivated, while that person no longer has Full access, or while your organization has the feature or Allow Public Artifacts off. It works again if that is undone before it expires. To end a link for good, turn it off.
  • Workspace admins can turn public artifacts off for the whole organization in Settings → Artifacts → Allow Public Artifacts. While it is off, nobody (people or agents) can make an artifact public, and every existing public link stops working. Owners can still turn their links off. Switching the setting back on resumes links that have not expired.
  • Viewers see only the raw file. Interactive HTML runs in an isolated sandbox with no access to Runlayer.
  • Turning a public link on or off, or changing whether it requires an email, is recorded in the audit log as agent_artifact_public_access_changed and agent_artifact_public_email_requirement_changed.
  • To check public links from your own tools (for example a DLP scanner), list artifacts with the Artifacts API: each one says whether it is public and requires an email, and you can turn a link off.
  • Assistants and agents can call set_artifact_public_access through Runlayer MCP. They are instructed to use it only when you explicitly ask, after warning you.

​
Require an email to view

To see who opens a public link, turn on Require email to view when you make the artifact public, or later from the Public badge. Changing it keeps the same link.
  • Visitors type an email before the artifact opens. A browser that has entered an email for a link is not asked again while the link lasts.
  • Each visit shows up in the artifact’s Views & visitors under that email, marked Public link.
  • Emails are not verified: they are what the visitor typed. They attribute views and grant no access; the link alone still opens the artifact.
  • Visits to a public link that doesn’t require an email are not counted.
  • Turning the public link off clears the setting, and a new link starts without it unless you turn it on again.
  • Agents can turn it on when they make an artifact public, with the require_email argument of set_artifact_public_access. To change it on a link that is already public, use the Public badge.
  • Check that they are signed in to the correct Runlayer organization.
  • Review the artifact’s Share panel and, for an agent artifact, the originating agent’s sharing settings.
  • Ask an administrator to check that the recipient has Use Agents or Manage Agents access.
  • Confirm the artifact has not been deleted.
See Roles & Permissions for workspace permissions.