@@ -18,6 +18,11 @@ product overview.
 
 ## Unreleased
 
+- Add a manager/admin-only Access page to Slack channel settings for base mode (including Admin), Auto, Lean,
+  network, use/manage policy, and named guest/manager lists. Recheck live membership and current
+  roles on save; immediately acknowledge submissions while validation runs. Admin-author-only
+  engine bypass and existing ordinary-tab access remain unchanged.
+
 - Channels: use Read-only, Worker, and Admin as the three base modes, with independent Auto and
   Lean side toggles in channel, DM, and template editors. Slack Settings can now select Admin
   for authorized admins. Admin gives other members Worker plus their selected options; Auto
 
@@ -58,13 +58,13 @@ A categorized catalog of what's shipped. Cross-linked to `TEST-PLAN.md` checks.
   never has to carry a per-author sentence, and a channel with no Composio gets no line at all.
   → TEST-PLAN: Composio identity and connection discovery.
 
-- **Focused conversation settings:** Access presents Read-only, Worker, and Autonomous as the
-  primary modes, with Full access and Lean as clearly separated special-mode boxes; Custom is no
+- **Focused conversation settings:** Access presents Read-only, Worker, and Admin as the
+  base modes, with Auto and Lean as independent options; Custom is no
   longer offered. MCP Connections, Cloud MCP, Environment tokens, and Skills are separate first-class
   channel pages rather than nested beneath Tools; enabled skills sort first and the channel-level
   Grant Tier switch is gone.
 - **Slack settings for authorized users:** replies requested by anyone allowed to use the agent add a
-  requester-bound **⚙️ Settings** footer button. Its four-tab Block Kit console mirrors the web
+  requester-bound **⚙️ Settings** footer button. Its Block Kit console mirrors the web
   setup concepts: Engine & model can be changed by every authorized user in this console; MCP Connections
   rotates/removes the write-only Composio, Toolbox and Make MCP credentials plus inherited-token
   policy, and edits the Composio account label shared with the web setup form. Labels are shown
@@ -78,6 +78,12 @@ A categorized catalog of what's shipped. Cross-linked to `TEST-PLAN.md` checks.
   so historic controls cannot retain revoked access. Cloud MCP actions additionally re-check admin
   status. Secrets can be edited in every channel mode, including through `/secrets`; file-edit
   permissions and the separate `/model` command policy are unchanged.
+  **Access** is a fifth tab, visible only to current admins/channel managers. They can edit the
+  base mode (including Admin/full access), Auto, Lean, network, use/manage policy and named guest/manager lists. Selecting
+  Full access does not grant anyone an administrator role; bypass still requires an admin author.
+  Saves acknowledge immediately with a progress view, validate named users against live human
+  channel membership, re-check management and roles at the write boundary, and audit policy changes.
+  DMs keep the existing four tabs. Work-dir and gateway-wide settings are not exposed here.
   → TEST-PLAN: Conversation settings + on-demand memory.
 - **Truthful guest access:** approved members appear selected because they already have access;
   admins are selected and locked, while explicit guest grants remain independently editable.
@@ -1363,16 +1369,16 @@ A categorized catalog of what's shipped. Cross-linked to `TEST-PLAN.md` checks.
   read-only permission profile intentionally withholds command execution. → TEST-PLAN: Engines.
 - The web channel editor, custom DMs, and default templates share the three-mode picker and
   side toggles. The Slack reply's **Settings** button exposes Read-only/Worker/Admin plus Auto/Lean
-  on its Runtime tab; only current gateway admins can select Admin. Every click rechecks user
+  on its manager/admin-only Access tab for channels. DMs retain Runtime mode controls with
+  Admin selection restricted to admins. Every click rechecks user
   authorization and channel membership, and every change is audited. `/mode read|worker|admin` changes the
   base while preserving applicable options (`bash` remains a compatibility alias). Legacy run-API
   presets remain accepted with their existing capability-reduction boundary.
 - **Two-axis access model** (per channel, both editable in the admin UI): **Who can use** (`meta.access`:
   Approved members / Admins only / Locked) and **Who can manage** (`meta.manageAccess`: Org admins only /
-  Channel members / Custom + `meta.managers[]`). A channel manager may change SAFE settings (capability
-  up to Autonomous, skills, connectors, the MCP allowlist) but **never** Full-access / network / work-dir —
-  those stay org-admin-only. Enforced in the gateway control MCP (`requireManage` vs `requireAdmin`) and
-  the in-thread `/mode` command; default `admins` means relaxing it is strictly opt-in. Settings →
+  Channel members / Custom + `meta.managers[]`). The Slack Access page delegates channel mode (including Admin), Auto, Lean, network and use/manage policy to
+  current managers. Work-dir stays org-admin-only. The gateway control MCP (`requireManage` vs
+  `requireAdmin`) and in-thread `/mode` command retain their narrower admin checks; default `admins` means relaxing it is strictly opt-in. Settings →
   **Reset all channels' access to default** (confirm-gated, audit-logged) restores use/manage to defaults
   and clears custom guest + manager lists, leaving capability/skills/tokens untouched.
   → TEST-PLAN: channel access model.
 
@@ -15,9 +15,10 @@ pass. Many checks are manual (require a real Slack workspace + an authenticated
   stays. Enable Auto: Worker is selected. At wide widths options sit beside the base choices;
   narrow screens stack without overflow.
 - Slack Settings acceptance (engine-independent): as an admin fixture actor open a recent reply's
-  Settings button, choose Admin, and toggle Auto/Lean independently. Reopen and verify persistence
-  and the `slack-settings` audit event. A member-manager sees Read-only/Worker and both options;
-  a forged Admin action or revoked authorization/membership grant is rejected before mutation.
+  Settings → Access button, choose Admin, and toggle Auto/Lean independently. Reopen and verify persistence
+  and the `slack-settings` audit event. A member-manager sees all three modes and both options; ordinary members do not see Access.
+  Forged legacy Runtime mode actions and revoked authorization/membership grants are rejected.
+  DMs keep Runtime mode controls with Admin restricted to admin authors.
 - Runtime acceptance (Claude AND Codex): in an isolated fixture set Admin + Auto + Lean. As the
   approved non-admin fixture actor ask "Create mode-check.txt containing MODE_OK, read it back,
   and reply with its contents." Pass only with matching saved bytes, no approval click/card,
@@ -138,7 +139,8 @@ a pass.
 Automated: `test/channel-memory.test.js`, `test/memory-search.test.js`,
 `test/memory-snapshot-run.test.js`, `test/channel-members-ui.test.js`,
 `test/access-grants.test.js`, `test/gateway-mcp-authz.test.js`,
-`test/mcp-control-plane-approval.test.js`, `test/channel-settings-modal.test.js`.
+`test/mcp-control-plane-approval.test.js`, `test/channel-settings-modal.test.js`,
+`test/access-settings.test.js`.
 
 - [x] Large MEMORY.md and topic writes succeed without a character-capacity failure.
 - [x] On an engine without FTS5 (Node 22.13) the database opens, migration 17 is skipped with a warning, and `search_channel_memory` answers from the plain scan with AND semantics, diacritic folding and bracketed excerpts; `ensureMemoryFtsTable` is idempotent and creates the index the moment the engine supports it.
@@ -167,6 +169,35 @@ Automated: `test/channel-memory.test.js`, `test/memory-search.test.js`,
       authorization and Slack membership before every mutation. Cloud MCP is hidden from non-admins
       and its controls reject revoked admin status; all authorized users can edit runtime and secrets
       in every channel mode regardless of manager policy.
+- [x] Automated Access: ordinary authorized users cannot see/forge the fifth tab; admins,
+      approved members under Members policy and named managers under Custom policy can edit it.
+      DMs keep four tabs. Independent base-mode/Auto/Lean/network flags round-trip; preset
+      flags and stored profile agree. Unknown fields cannot change workDir, credentials or roles.
+      Real store saves preserve unrelated settings and audit only policy. Departed actors,
+      outsiders/bots in named lists, revoked channel grants and global role revocation during the
+      final membership request are rejected. Submission acknowledgment precedes asynchronous work.
+- [ ] Live Access UI (engine-independent Slack callback case): create disposable Slack channel
+      `access-settings-qa`, join an admin actor, an approved member, a named external guest, and
+      the bot. Start with Worker, network/Full access/Lean off, Approved use, Admins manage, and
+      no explicit grants. From a fresh reply open Settings as each actor. Only admin sees Access.
+      Change manage to Members; approved actor now sees Access, guest does not. Save Admin mode,
+      Auto, Lean, network, named guest, and Custom management with the approved actor
+      named. Reopen Slack and web settings: all values agree; unrelated model/tokens are unchanged;
+      audit identifies actor/channel and contains no secrets. Clear special flags/lists and save:
+      all clear. Try a bot and a user outside the channel: save fails without changing metadata.
+      Revoke management or remove the actor with the editor open: old submit fails. Delay Slack
+      membership responses beyond three seconds: immediate progress view, then one final result;
+      no Slack timeout or double save. Restore/delete fixture. Pending live execution.
+- [ ] Live Access Claude and Codex (one run each in disposable channel `access-settings-qa`):
+      select engine explicitly, Admin mode, Auto/Lean/network off, Members management.
+      As approved non-admin, prompt “Create access-proof.txt containing access proof and report
+      whether permission bypass is active.” As admin, repeat with a different filename. Pass when
+      per-run launch evidence has bypass only for the admin author and both runs stay in their
+      declared container mounts. As the non-admin actor, enable Lean and start a fresh thread: “List the connectors and
+      skills available in this run.” Pass when runtime evidence shows the lean tool/skill policy.
+      Toggle network and ask “Is network use allowed here?”; compare the answer and launch policy
+      to the stored setting (advisory network is not an egress isolation claim). Restore fixture
+      settings/files; retain launch/audit evidence. Pending live execution for both engines.
 - [ ] Live Claude: in `cg-testing-claude-auto`, keep Who can manage set to Admins and Apps approved
       but not a manager. Let Apps request a fresh reply and open **⚙️ Settings**. Pass when Apps
       can change to another valid engine/model/effort and restore it; cannot see or operate Cloud MCP;
 
@@ -241,8 +241,8 @@ const ACCESS_HELP = {
   none: "Locked — nobody can use the bot here until you add them by name in the Users tab (Allowed users).",
 };
 const MANAGE_HELP = {
-  admins: "Only gateway admins can change this channel's settings (from Slack or here). (Default.)",
-  members: "Any approved member of this channel can change the safe settings (capability up to Autonomous, skills, connectors) — but never Full access, network or work-dir.",
+  admins: "Only gateway admins can edit the Slack Access page. Other authorized users can edit the ordinary Settings tabs. (Default.)",
+  members: "Any approved channel member can edit Slack Access settings: Read-only/Worker/Admin mode, Auto, Lean, network, access policy and named users/managers. Permission bypass still requires an admin author. Work-dir stays admin-only.",
 };
 function channelProfileOf(m = {}) {
   if (m.adminMode) return "admin";
 
@@ -1107,7 +1107,7 @@ <h2 class="ch-name"></h2>
           <label class="togglerow ch-network-wrap">
             <input type="checkbox" class="ch-network" />
             <span class="switch"></span>
-            <span class="t"><b>Network</b><small>tells the engine whether this channel is meant to use the network; the container itself stays on the bridge network until the egress proxy ships — needs Bash, admin-only</small></span>
+            <span class="t"><b>Network</b><small>tells the engine whether this channel is meant to use the network; the container itself stays on the bridge network until the egress proxy ships — editable by admins and channel managers in Slack Access settings</small></span>
           </label>
           </label>
 
 
@@ -181,7 +181,7 @@ export function defaultChannelMeta({ channelId, name, type, isDM, platform }) {
     platform: isPlatformId(platform) ? platform : DEFAULT_PLATFORM,
     access: "approved", // who can USE the channel: "approved" | "admins" | "none" (set from the gateway
     // default at join). Governs who's auto-granted in a channel; allowedUsers is the manual override.
-    manageAccess: "admins", // who can MANAGE (change safe settings) from Slack: "admins" | "members" | "custom".
+    manageAccess: "admins", // who can MANAGE the Access page from Slack: "admins" | "members" | "custom".
     managers: [], // when manageAccess="custom": Slack user ids allowed to manage this channel.
     profile: isDM ? undefined : "read", // capability preset: read|worker|auto|full|lean|custom (see modes.js);
     // expands to the flags below on save. undefined/legacy channels derive it from the flags.
 
@@ -161,6 +161,9 @@ and friends read `SUPABASE_ACCESS_TOKEN` / `VERCEL_TOKEN` without being told to.
 The Slack **Settings** reply button is available to every authorized agent user, including channel
 guests. It allows editing engine/model/effort, channel skills and templates, MCP connection tokens
 and labels, and write-only secrets. Cloud MCP is visible and editable only by current admins.
+A separate **Access** tab is visible only to admins and current channel managers. It edits mode,
+Admin/full access, Auto, Lean, network, who may use/manage the channel, and named guests/managers. Manager
+policy applies to this entire page; changing Full access still leaves run-time bypass admin-author-only.
 Every interaction re-checks agent access and channel membership. This console does not grant
 admin rights or change the permissions required by separate gateway control tools.
 
 
@@ -41,10 +41,10 @@ export function authorModeMeta(meta, { isAdminAuthor = false, untrustedPrincipal
 
 // Called inside the atomic settings update; changing a base mode preserves Lean and Auto.
 // Read-only clears Auto; enabling Auto on Read-only promotes it to Worker.
-export function modeSettingsPatch(current = {}, { mode, autoMode, cleanMode } = {}, { isAdminUser = false } = {}) {
+export function modeSettingsPatch(current = {}, { mode, autoMode, cleanMode } = {}, { isAdminUser = false, canEnableAdmin = isAdminUser } = {}) {
   const nextMode = mode || channelMode(current);
   if (!MODES.includes(nextMode)) throw new Error("Mode must be read, worker, or admin.");
-  if (mode === "admin" && !isAdminUser) throw new Error("Only administrators can enable Admin mode.");
+  if (mode === "admin" && !canEnableAdmin) throw new Error("Only administrators can enable Admin mode.");
   const patch = mode ? { ...BASE_MODE_FLAGS[nextMode], profile: nextMode } : {};
   if (mode === "read") patch.autoMode = false;
   if (typeof autoMode === "boolean") {
@@ -147,14 +147,15 @@ export function isAuthorized(meta, authorId, isDM, { isAdminUser = false, isAppr
 }
 
 // ── Who can manage a channel ──────────────────────────────────────────────────
-// "Manage" = change this channel's SAFE settings (capability profile up to Autonomous, skills,
-// connectors) from inside Slack. Governed by meta.manageAccess (default "admins"), so existing
+// "Manage" authorizes the Slack Access page (mode, Full access, Lean, network, use/manage
+// policy and named users). Engine permission bypass still requires an admin author. Governed by
+// meta.manageAccess (default "admins"), so existing
 // channels are unchanged and relaxing it is strictly opt-in per channel:
 //   - "admins"  → gateway admins only (default)
 //   - "members" → any approved member (membership is implied by posting in the channel)
 //   - "custom"  → only the users listed in meta.managers[]
-// The DANGEROUS escalations (Full-access / network / work-dir) are NEVER delegated here — the call
-// sites keep requiring an admin author for those. This function only answers "safe-manage?".
+// Individual MCP tools and /mode keep their narrower admin checks for Full access/network;
+// work-dir remains admin-only. Ordinary Slack Settings tabs use agent authorization separately.
 export function canManage(meta = {}, { authorId = "", isAdminUser = false, isApprovedUser = false } = {}) {
   if (isAdminUser) return true;
   const mode = meta.manageAccess || "admins";