Skip to main content

Invite People and Manage Access

Use this guide as an owner or administrator managing workspace access. Team invitations require Growth or Business plus team.invite. Assigning roles requires team.update_role; removing members requires team.remove_member.

Invite a team member​

  1. Open Account Management → Team.
  2. Select Invite Team Members.
  3. Enter the person's email address.
  4. Choose a role. A user without role-assignment permission can invite only as Member.
  5. Select Send Invite.
  6. Confirm the invitation appears in the team workflow.

Available templates are Owner, Admin, Member, Viewer, Support Analyst, Content Manager, Billing Admin, and Security Admin. Use the generated Roles and Permissions Reference to choose one; this page does not duplicate the matrix.

Restrict assistant access​

Open Account Management → Permissions, select the member, choose a role template, and set assistant scope:

  • All assistants stores an empty scope and allows every assistant permitted by the role.
  • A selected list restricts assistant-specific actions to those assistant IDs.

Save, then read the effective-capability summary. Do not use assistant scope as a substitute for choosing the least-privileged role.

Change or remove access​

Use Permissions to change a non-owner's role or scope. Use Team to remove a member. Removing access is security-sensitive: confirm the target person and intended assistant coverage before saving. The Owner role is protected from ordinary member permission editing.

Verify access​

Ask the user to sign in again or refresh the dashboard, select an in-scope assistant, and perform one intended read or write action. Also test one action that should be denied. A successful page load alone does not prove permission to mutate or export.

Common failures​

  • Invite unavailable: verify Growth/Business and team.invite.
  • Only Member can be selected: the inviter lacks team.update_role.
  • Page visible but action denied: check the specific permission key.
  • One assistant works and another fails: inspect the non-empty assistant scope.
  • “All assistants” fails: a scoped account must choose a specific in-scope assistant for routes that reject scoped all-assistant queries.

Collect the user's role template, assistant scope, attempted route, assistant ID, and exact error before escalation. Do not send tokens or message content.