Workspaces, members & roles

Creating a workspace

1. You receive a default workspace on sign-up — you're the owner.
2. To create another, open the workspace switcher in the top bar and choose New workspace.
3. The slug is auto-generated from the name and used in workspace-scoped URLs.

Roles

• Owner — billing, plan changes, workspace deletion, all admin actions.
• Admin — manage members, integrations, security policies, projects.
• Editor — create and edit projects, mappings, generations, and packages.
• Viewer — read-only access to projects, mappings, previews, and downloads.

Roles live in the workspace_members table and are checked by the has_any_role security-definer function — they cannot be elevated client-side.

Inviting members

1. Go to Settings → Members and click Invite.
2. Enter an email address and choose a role. An invitation email is sent.
3. Pending invites are listed below the member roster — you can revoke or resend at any time.

SSO-provisioned members

If your workspace has Enterprise SSO and a verified domain, anyone signing in with an email at that domain is added to the workspace automatically with the role specified in the IdP claims. See Enterprise SSO.

Activity & audit

Every privileged action — role change, secret rotation, policy update, package download — is recorded in audit_log. View the feed at Settings → Activity or jump to the recent feed in the Security Center.

Leaving or deleting

• Members can leave from their profile page. Owners must transfer ownership first.
• Workspace deletion is owner-only, soft-deleted for 30 days, then hard-deleted along with all projects, mappings, and packages.