Invite your team

Everyone in a workspace holds exactly one role, and that role decides what they can do. There are five, and they are the same in every workspace.

The five roles

Role	For
Owner	Runs the workspace — members, roles, billing, and settings
Admin	Day-to-day administration, including inviting people below them
Employee	The standard role for someone doing the work
Developer	An Employee who can also reach the developer console and API keys
Read-only	Can see, cannot change

One person holds one role per workspace. If someone needs different access in a different workspace, that is a separate membership with its own role.

Who can invite whom

Inviting is deliberately asymmetric, so an Admin cannot quietly promote someone above themselves.

Action	Creator	Owner	Admin	Everyone else
Invite someone as Owner	Yes	Yes	No	No
Invite as Admin or lower	Yes	Yes	Yes	No
Promote a member to Owner	Yes	Yes	No	No
Remove a non-Owner	Yes	Yes	No	No
Remove an Owner	Yes	No	No	No

That last row is the one worth remembering. Removing an Owner is reserved for the person who created the workspace — see Create your workspace for why the creator is tracked separately.

Access is checked on our side, always

Roles are not just a matter of which buttons the interface shows you. Every request is re-checked on the server against your membership and role, so hiding a button is a convenience, never the security boundary.

Next

Once people are in, decide where their work should live: Where things live.