People and teams, and who can do what.
Invite people to your organisation, group them into teams, and decide who can open and change each workspace, project and document. Agents and AI tools never get more than the access you give them.
Roles in the organisation
| Role | What it allows |
|---|---|
| Owner | Everything, including deleting the organisation. An owner cannot be removed; to move ownership to someone else, contact support. |
| Admin | Manage members, teams, settings, billing, single sign-on, connectors and AI settings |
| Member | Work in the workspaces and projects they are given |
Organisation settings open for owners and admins only.
Invite people
Open Organisation settings, then Members or Invitations
The Invitations page lists invitations still waiting, and lets you send them again or cancel them.Invite by email
Choose whether each person joins as a member or an admin.Give them access
Add them to the workspaces they need, directly or through a team.
Seats
Workspaces, projects and documents
Access flows down: an organisation holds workspaces, a workspace holds projects, and a project holds its documents, whiteboards, plans and databases. Anyone with access to a workspace can view its projects by default.
- Workspace roles: viewer (can view content), editor (can edit content) and admin (full workspace control).
- Projects and documents can be shared more narrowly: no access, read only, read and write, or admin, for a person or a team.
- Override access on a project sets, for each of documents, whiteboards, plans and improvements, whether someone may read, write or delete: inherited, allowed or denied.
- Databases have their own switches when you give a person or a team access to a project or a workspace: read, write and delete. They never follow documents, so with nothing ticked, that access opens none of the databases there. Someone you invite by email gets database access from the level you give them; change it once they have joined.
Teams
Teams group people so you can give them access together. Create a team, add its members, and give it read, write or admin access to workspaces under Team Access in each workspace's settings. Teams are on the Pro and Enterprise plans.
Deactivate or remove
- Deactivate pauses someone's access without deleting anything, stops their connected AI tools, and frees their seat. Reactivate them at any time.
- Remove takes them out of the organisation for good. Their AI chats in the organisation are deleted and cannot be brought back; the dialog lists what goes and what stays before you confirm.
Admins can also send a member a password reset, or reset their two-factor authentication if they lose their device. An admin cannot do either for an owner.
Signing in
People sign in with Google, or with an email and password plus a code from an authenticator app. Organisations can also use their own identity provider: see Single sign-on.
Agents and AI tools
An agent reaches only the workspaces and projects it was given, and a connected AI tool only what its key or sign-in allows, never more than the person it acts for. What they change is recorded under their own name.
The activity log Enterprise
On Enterprise, Activity in organisation settings lists what happened across the organisation: document edits, member changes and security events, with a mark on anything an agent or an AI tool did.