Skip to main content
Team access is stored per workspace. Only active members can open workspace data.

​
Roles

The general access layer also understands a Viewer role for authorization compatibility. Durable team invites and role changes currently use Owner, Admin, and Member. The Team UI invites Admin or Member.

​
Invite flow

1

Enter the member

Supply an email, display name, and Admin or Member role.
2

Create the invited record

The status is invited and joinedAt remains empty.
3

Activate membership

The identity must be matched and the membership made active before it grants workspace access.
Email uniqueness is case-insensitive within the workspace.
Invite delivery is currently a mocked or logged integration. Creating an invited record does not prove that an external email was delivered.

​
Management rules

  • Owners and admins can manage team records.
  • Only an owner can add, change, or remove another owner.
  • The last active owner cannot be demoted or removed.
  • An invited member does not gain access until active.
  • Cross-workspace member identifiers are returned as not found.
The current UI does not offer role changes or removal for an Owner. The service preserves the stricter owner-only path for supported administrative calls.

​
Removing access

Removal takes effect at the membership layer. Existing workspace API keys are separate machine credentials and are not revoked automatically when a person is removed. Review API keys after an ownership or operator change.