Skip to main content

Workspace settings: People and access

Where to find it: Settings → Workspace → People & access (/settings/workspace/people). Anyone allowed to view the member list can open it. The invite form and management controls only appear for users who can manage members.

Use this tab to invite people, see who is already in the workspace, and control exactly what each person can do.

How do I invite a member?​

Only visible to users who can manage members.

  • Email address field.
  • Role dropdown: Member or Admin. Admin is only offered to the workspace Owner, so an Admin cannot invite another Admin.
  • If the role is Member, an Initial project access section appears: a checklist of the workspace's projects. Checking a project gives the new member view-only access to it from the moment they accept, and access can be broadened afterward. Archived projects are shown but cannot be selected.
  • Invite sends the invitation. It is disabled until an email is entered. Pressing Enter in the email field also submits.

If the invite fails, an error appears above the member list, for example "Could not send the invitation."

Member list​

Every member is listed with an avatar and name (marked (you) for you), an email address, and a role badge: Owner, Admin, or Member.

If you can manage members, each row you are allowed to act on also shows:

  • Role selector: a dropdown to switch the member between Member and Admin. Only the Owner can do this. The Owner's own row cannot be changed here, and members cannot edit their own role or remove themselves this way.
  • Expand arrow: reveals that member's permission grants (see below).
  • Remove (×): removes the member from the workspace immediately.

A member who is not allowed to manage others sees the plain list with no controls, just names, emails, and role badges.

How do per-member permissions work?​

Clicking the expand arrow on a manageable member opens a grants panel with two sections.

Workspace grants​

A set of on/off switches. What is offered depends on the member's role:

  • Admin members: one switch, Manage billing. Everything else an Admin can already do by default.
  • Member-role members: a full list of individually toggleable capabilities:
    • Edit workspace
    • Create projects
    • Manage members
    • View integrations
    • Manage integrations (turning this on also turns on "View integrations"; turning "View integrations" off turns this off too)
    • View billing
    • Manage billing (same auto-link with "View billing")
    • View audit

Each switch is disabled if you do not hold that same capability yourself. You cannot grant a permission you do not have.

Project grants​

Member-role members only. Below the workspace grants, one card per project the member has any access to, grouped into checkboxes by area:

  • Project: View project, Edit project, Delete project, Use project chat.
  • Software factory: Read, create, edit, delete, run, and approve issues; Save and ship; Read and manage repositories; Read, review, and merge pull requests; Read and manage deployments; Read and manage environments.
  • Knowledge and automation: Read and manage knowledge, agents, and discovery.
  • Operations: Read and manage monitoring, incidents, and security; Read costs.
  • Secrets: Read secret metadata, Manage secrets.

Checking any capability also checks View project automatically, since a project cannot be touched without being viewable, along with anything it depends on (for example, checking "Manage repositories" also checks "Read repositories"). Unchecking "View project" clears every other checkbox for that project. Unchecking a capability that others depend on also unchecks those.

Pending invitations​

Below the member list, visible to those who can manage members, a separate list shows invitations sent but not yet accepted:

  • Email address, role, and expiry date.
  • If the invite includes project access, the project names are listed underneath.
  • A Cancel (×) button on each revokes the invitation immediately.
On this page