Users, roles & invites
Everything member-related lives in Admin — users, roles, groups, workspaces, and invitations.
The Users tab lists every member with their role, status, SSO provider, and last login. Admins can create and edit users, deactivate accounts, reset passwords, and send invites.
System roles
Section titled “System roles”Three immutable roles ship with every workspace:
| Admin | Editor | Viewer | |
|---|---|---|---|
| View dashboards & reports | ✓ | ✓ | ✓ |
| AI chat | ✓ | ✓ | ✓ |
| Create & edit dashboards, reports, sources, models, queries | ✓ | ✓ | — |
| SQL editor | ✓ | ✓ | — |
| Share | ✓ | ✓ | — |
| Export (PDF/CSV/…) | ✓ | ✓ | — |
| Delete content | ✓ | — | — |
| Manage users & settings | ✓ | — | — |
Custom roles
Section titled “Custom roles”Need something between Editor and Viewer? Create a custom role: a name, description, and a permission grid — View / Create / Update / Delete per menu, across both application and admin menus. (The Menus tab customizes the menu structure those permissions attach to.) System roles can’t be edited or deleted, and a role assigned to users can’t be deleted until they’re moved.
Groups & workspaces
Section titled “Groups & workspaces”The Groups tab manages group membership; Workspaces manages the workspaces themselves.
Inviting people
Section titled “Inviting people”From Invites (or the Users tab), send an invitation with:
- the person’s email,
- a company role — Member, or Admin (admins manage users and company settings),
- optionally a workspace role from the roles above.
Pending invitations can be resent or cancelled and show their expiry; a history records accepted, cancelled, and expired invites.
The recipient clicks the invite link, sees the workspace name and their email, sets a password (minimum 8 characters including a number or special character), and activates their account.
Related
Section titled “Related”- SSO & MFA — sign-in with your IdP and two-factor auth.
- Workspace settings