Members and invites
Invite somebody, and see how many seats your plan covers.
Settings then Members is the roster of people in this workspace. Each row carries the person and the roles they hold at the workspace level. Roles granted on one project appear on that project's Access page instead.
The seat line
The subtitle counts seats used against what your plan covers. Members and pending invitations both count toward that number, so a seat is held from the moment you send the invitation.
Free covers 3 seats. Pro and Enterprise cover as many as you buy. Machines never take a seat, so no identity appears here and none appears on the invoice.
Once every seat is in use, the header becomes an upgrade prompt and the invite dialog says so.
When the roster cannot be read, the seat count drops out of the subtitle and the invite button is disabled with a note saying the usage could not be checked. The invite action re-checks the cap on the server anyway, so a failed read is never what lets an extra seat through.
Inviting
The dialog asks for an email address and a role. You can only offer a role whose permissions you hold yourself, and the server checks that again after the form is posted.
An invitation lasts 7 days. Accepting it happens at /invite/accept, which needs the person to be signed in and checks nothing else.
Changing what somebody can reach
Changing a member's role here changes it at the workspace level. To give somebody one project or one environment, use that project's Access page instead. Roles and permissions has the full catalog.
Removing somebody
Removing marks the membership rather than deleting the row. What ends is access, on their next request: every live session pointing at this workspace is revoked, and every grant they held here is dropped at any scope.
The person's account is untouched, because it is shared with every other workspace they belong to.
Removing the last owner is refused. A workspace with no owner is a workspace nobody can delete or hand over.
Offboard a member has the order to do this in when somebody leaves.
What each action needs
| Action | Needs | Confirm it is you | Recorded as |
|---|---|---|---|
| Open the roster | member:read | No | not recorded |
| Invite somebody | member:invite | No | member.invited |
| Send the invitation again | member:invite | No | member.invite_resent |
| Withdraw an invitation | member:remove | No | member.invite_revoked |
| Change a member's role | member:role_assign | No | role.assigned |
| Remove a member | member:remove | No | member.deprovisioned and member.removed |
| Remove an owner | member:remove | Yes | member.deprovisioned and member.removed |
Ending those sessions is kept with the sign-in history rather than in the audit log, so do not go looking for a row about it.
member.deprovisioned is the one entry here the action picker carries. For the rest, narrow by actor and date, then export. See browsing the record.
Next: roles and permissions.