---
title: "Per-address mailbox access"
description: "Share one address with a teammate and that is all they read. Every list and every thread is checked on the server against the addresses they hold."
url: "https://openemail.uk/features/scope"
---

[Workspaces & team](https://openemail.uk/features.md#team)

# Scoped visibility One address means one address.

Give somebody billing@ and billing@ is all they read. The server checks what they hold on every read, and again as each thread opens.

[Open mail](https://openemail.uk/mail/inbox) [Get Started](https://openemail.uk/signup.md)[All features](https://openemail.uk/features.md)

In short

## What is scoped access to a shared mailbox?

When several people share one mailbox, scoping decides which addresses each of them can read. It only counts if the server enforces it: an address hidden in the interface is still one crafted request away.

How it works

## The server decides, on every read

Access comes from the signed-in session, never from the request. Ask for an address you do not hold and the request is refused.

## Every thread is checked again

Open a thread outside your addresses and the server answers Thread not found. Every action on a thread, down to an attachment download, repeats the check.

## Switch it off, access goes too

Everyone it was shared with loses the address the moment its Receiving switch goes off, and has it back when the switch goes on.

What you get

## In the product today

Whole domains too

A domain grant covers every address on it, including ones made later.

Counts stay inside

Folder and unread counts only cover the addresses somebody holds.

Roles never widen it

A role says what somebody may do, never which addresses they may read.

Owner reads everything

It comes with the workspace, not a grant. Everyone else reads what they hold.

Good practice

## Getting the most out of it

1. 01
   
   Check who reaches it
   
   Before sharing, open the address page: Who can reach it lists everyone, whole-domain grants included.
2. 02
   
   Prefer single addresses
   
   Grant a whole domain only when they should also get every address added to it later.
3. 03
   
   Switch off to pause
   
   Switching an address off cuts access but keeps its grants, while removing it deletes them.

Questions

## Asked often

Keep going

## Works well with

Share an address

Hand billing@ to the person who does the billing.

Roles & permissions levels

A role says what somebody may do; an address grant says what they may do it to.

Invitations

Share with someone who has not signed up yet and have them invited.

Start

## Your domain, your mail.

Point a domain at OpenEmail and read it in a mailbox built around it. The free plan covers one domain.

[Open mail](https://openemail.uk/mail/inbox) [Get Started](https://openemail.uk/signup.md)[Read the reference](https://openemail.uk/docs/knowledge/team/scope.md)