Teammates, roles & invites

A workspace is a team. This page covers adding people and setting their level of access.

Roles#

• Members (daily users) chat with agents, run missions, review deliverables, and approve actions. They cannot reach operator surfaces.
• Operators (owner / admin) do everything members can, plus create agents, set policy, manage skills, integrations, secrets, and the governance surface.

Note — The role boundary is enforced on the server, not just hidden in the UI. Admin, config, and destructive actions are gated server-side — a member can't reach them by guessing a URL. Operators get a "preview as daily user" toggle to see exactly what members see.

Inviting people#

Create an invite link from the members menu in the sidebar. One link, a few choices: a role, an expiry (7 days by default), an optional email to bind it to one person, and what it sets up on their machine — AI-tool discovery, and whether their coding agent is governed too (see Shadow-AI discovery). Whatever you choose, the app discloses it plainly on their machine before anything starts.

• Email-bound (recommended). Bind the link to a person's email. Only someone who signs in as that exact email can join. A leaked link is useless to anyone else.
• Open. Leave the email blank for a link anyone can use to join until it expires. The dialog flags this clearly, and it is still governed by your registration mode below.

Ceiling — Access is bound to a verified sign-in, never to a typed-in address. An email-bound invite is accepted only when the authenticated identity's email matches the link, so a self-typed email can never, by itself, grant access. Invite links are strong random tokens, rate-limited, and scoped to a single workspace. Setting up discovery only inventories a machine's AI tools — it never grants workspace access.

Who can join#

Set the workspace's registration mode in Settings → Workspace:

• Open — anyone can sign up.
• Invite — only people with a valid invite link (the default).
• Closed — no new signups.

Authentication is email + password (12-character minimum) or Google sign-in.

Next#

• Agents & scheduling — creating the AI side of the team.
• Policy & enforcement — what members are allowed to do.