Per-artifact today, which is a folder with versions.
You invite people as editor/viewer, or make a artifact public for link-sharing.
Agents get in via a token scoped to your account. There's no org layer yet — domain membership or SSO — that's next.
Is org-wide sharing what you actually need?