Teams
Roles and approvers
What owners, approvers and viewers can do, and how to limit who approves each project.
Each person in a workspace has one role. Everyone, whatever their role, sees all the team's agents.
#The three roles
| Owner | Approver | Viewer | |
|---|---|---|---|
| See the board, projects, weekly view | Yes | Yes | Yes |
| Allow, deny and message agents (when Agent chats is on) | Any project | Projects they may approve | No |
| Let an agent past a guardrail | Any project | Projects they may approve | No |
| Read agents' chats (when Agent chats is on) | Any project | Projects they may approve | No |
| See what a permission request is for, and agents' questions | Any project | Projects they may approve | No — just that an agent needs someone |
| Rename projects, move lanes | Yes | Yes | No |
| Invite people | Approvers and viewers | Viewers | No |
| Change roles, remove people, rename the team | Yes | No | No |
| Team-wide and per-person guardrails, notification channels | Yes | No | No |
| Publish public stats | Yes | No | No |
| Switch Agent chats on or off (whole workspace) | Yes | No | No |
| Create an agent-actions API key | Yes | Yes | No |
| See the audit log | Yes | Yes | No |
| Export data | Everything | All but team members' emails | All but team members and the audit log |
| Delete their own account | Yes (not while the last owner of a team with others) | Yes | Yes |
Everyone can create their own keys on Keys & connections to connect their machines.
Two more things limit answering, whatever your role:
- The agent's computer. Whoever runs an agent decides whether the app may answer it at all:
off(nobody, the default),own(only them) orteam(the project's approvers and owners too) — see Each computer decides too. - The plan. If the workspace's Team plan ends, everyone except the person who created the workspace can only look until Team is renewed — see When a Team plan ends.
For safety, team admin needs a sign-in from the last 7 days: changing roles, removing someone, creating invites, adding, removing or testing notification channels, creating keys other than ingest and telemetry keys, downloading exports, changing which public counters are published, opening Manage billing, "Share anonymous statistics", guardrails, choosing a project's approvers and Agent chats. If yours is older, sign out and in again.
When someone's role changes, any open invites they made for a role their new one can't give are revoked: an approver who becomes a viewer can no longer bring anyone in with an old link, and an owner who becomes an approver keeps only their viewer invites.
#Approvers per project
By default, every approver can answer every project's agents. For a project where only certain people should decide — a production service, say — an owner can name its approvers on the project's page. From then on only those people (and owners) can allow, deny, message or let its agents past a guardrail. The page shows who can approve.
Approvers per project are part of the Team plan; on Solo there's only you. Viewers can't be named as approvers. To give someone that power, make them an approver first on Team.
Every change of role, approvers or project setting is recorded in the audit log.