Roles & permissions
On this page
A role decides what someone can do. You pick one each time you invite a person, and it applies in the workspace or organisation you invite them to.
Which role do I pick?#
| You want them to | Give them | What the invite screen says |
|---|---|---|
| Run projects and work with the results | “Member” | “Standard access. Collaborates in the workspaces they’re added to.” |
| Also manage people and settings | “Admin” | “Manages members, workspaces, and organisation settings.” |
| See usage and invoices, and no content | “Billing” | “Sees usage and invoices. No project or content access.” |
| Work with you from outside your organisation | “External” | “Workspace-only guest. Not added to the organisation.” |
| Only look, for free, as your client | “Observer” | “Free, read-only. Sees projects, conversations, and reports. Cannot chat or generate reports.” |
Every role except Observer takes a seat.
There is one more role, and you cannot pick it: owner. The person who creates an organisation or a workspace is its owner. The dashboard shows an owner as “Admin”. In a workspace’s “Members” list the owner’s role is locked, with the note “Ownership is locked. Contact support to transfer.”
What each workspace role can do#
| Action | owner | admin | member | billing | external | observer |
|---|---|---|---|---|---|---|
| View projects | ✓ | ✓ | ✓ | ✗ | ✓ | ✓ |
| Create projects | ✓ | ✓ | ✓ | ✗ | ✗ | ✗ |
| Edit project settings | ✓ | ✓ | ✓ | ✗ | ✓ | ✗ |
| Change a project’s legal basis | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Delete projects | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Make a project private or visible again | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Share a private project | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Move projects | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Read conversations | ✓ | ✓ | ✓ | ✗ | ✓ | ✓ |
| Edit, tag or move conversations | ✓ | ✓ | ✓ | ✗ | ✓ | ✗ |
| Delete conversations | ✓ | ✓ | ✓ | ✗ | ✗ | ✗ |
| Use chat | ✓ | ✓ | ✓ | ✗ | ✓ | ✗ |
| View reports | ✓ | ✓ | ✓ | ✗ | ✓ | ✓ |
| Generate reports | ✓ | ✓ | ✓ | ✗ | ✓ | ✗ |
| Publish reports | ✓ | ✓ | ✓ | ✗ | ✗ | ✗ |
| Delete reports | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Invite people | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Change roles, remove people, see member emails and pending invites, act on access requests | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Workspace settings, delete the workspace, support access | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| View usage | ✓ | ✓ | ✓ | ✓ | ✗ | ✗ |
| View invoices, update payment | ✓ | ✓ | ✗ | ✓ | ✗ | ✗ |
| Webhooks | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| Custom workspace logo | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
Good to know when you read the table:
- A role is not enough for every row. Private projects and sharing them need the Innovator plan or above. The logo and webhooks (the project’s “Automation” page, Beta) need Changemaker. See tiers & billing.
- Billing gets no project at all, not even a private project that someone tries to share with them.
- Someone who opens a workspace or project they have no access to gets “not found”, the same answer as for one that does not exist.
- To change a role, use the role picker in the “Members” list. It offers “Member”, “Billing” and “Admin”.
External and observer#
These two roles are for people who are not in your organisation: a client, a consultant, a partner’s contact.
- External is a full collaborator from outside. They read, edit, chat and generate reports. They cannot create or delete projects, publish reports or invite anyone. An external takes a seat. On the organisation’s “Members” page they carry an “External” badge: “No organisation role. Access via workspace invites.”
- Observer is free and read-only: projects, conversations and reports. You can invite an observer only to a workspace made for an external client. Anywhere else the invite is refused: “Observers can only join workspaces for an external client. Pick another role.”
- Neither role has settings screens.
A person is inside your organisation or outside it, never both. If you invite a colleague as external or observer, dembrane refuses: “This person is already a member of your organisation, so they cannot join as an outside collaborator.”
You also cannot move someone across that line with the role picker (“You cannot switch between an outside collaborator and a member here. Invite them again with the new role.”). An observer’s role is locked in the same way: “Observers are free, read-only guests. To give edit access, remove them and re-invite as a member.” In both cases, remove the person and invite them again with the new role.
Organisation roles#
An organisation has four roles. Most people only need a workspace role.
| Action | owner | admin | billing | member |
|---|---|---|---|---|
| Open the organisation, see its member list | ✓ | ✓ | ✓ | ✓ |
| See other members’ email addresses | ✓ | ✓ | ✗ | ✗ |
| See usage for every workspace of the organisation | ✓ | ✓ | ✓ | only the workspaces they can reach |
| Open the “Usage” and “Billing” sections | ✓ | ✓ | ✓ | ✗ |
| Rename the organisation, edit its description | ✓ | ✓ | ✗ | ✗ |
| Invite people to the organisation | ✓ | ✓ | ✗ | ✗ |
| See, resend and revoke pending invites of the whole organisation | ✓ | ✓ | ✗ | ✗ |
| Change organisation roles, remove people | ✓ | ✓ (not for owners) | ✗ | ✗ |
| Create a workspace | ✓ | ✓ | ✗ | ✗ |
| Join a workspace without being invited | every workspace | open and invite-only | ✗ | ✗ |
| Approve or decline requests to join a workspace | ✓ | ✓ | ✗ | ✗ |
| Request access to an open workspace | joins directly | joins directly | ✓ | ✓ |
| Open “MCP access” in organisation settings | ✓ | ✓ | ✗ | ✗ |
| Offers, billing details, tasks and invoices | ✓ | ✓ | ✓ | ✗ |
- The role picker on a person’s card offers “Member” and “Admin”. You give “Billing” through the invite screen.
- An organisation role is not a workspace role. What an organisation admin can reach without an invite depends on each workspace’s access setting. See visibility & discovery.
- The organisation Billing role never opens a workspace or its projects.
- There is no external or observer role for an organisation. Those two exist only in a workspace.
Rules that protect you#
- Nobody can give a role above their own. An admin cannot make someone an owner. For this rule the order is observer, external, member, billing, admin, owner. The order says nothing about what a role can do: Billing sits above Member and can do far less.
- Only an owner can change or remove an owner.
- The last admin stays. A workspace’s last admin cannot be removed, demoted or leave, and an organisation’s last admin cannot be demoted: “This is the last admin. Make someone else an admin or owner first.”
- Someone who is an external on any workspace of your organisation cannot become its organisation admin.
- dembrane staff hold none of these roles. They reach a workspace only when you allow it. See staff support access.
Related#
- Invites & access: how you add people and what they see.
- Visibility & discovery: who can find and join a workspace.
- Organisations & workspaces: the two levels roles live in.
- Tiers & billing: seats and what each plan includes.
- The partner program: workspaces for an external client.
Comments