Workspace roles and project roles
Use Workspace People for workspace invitations and authority such as owner, admin, manager, member, finance, or observer. Use Project Team for developer, tester, and client assignments. A guest joins an explicitly invited review context.
Effective access depends on the account's workspace authority and project role. A client on one project may be a developer on another; access granted on one does not expose internal content on the other.
| Project role | Typical work |
|---|---|
| Owner | Manage the project, configure backend evidence, and perform owner-only permanent deletion. |
| Developer | Investigate, work on fixes, and submit status changes subject to approval rules. |
| Tester | Triage, change permitted statuses, and carry out verification. Testers participate in staff-only comments. |
| Client | Report and discuss permitted public issues; no internal staff context or MCP access for that project. |
| Guest | Report/comment in the invited public review context. A guest is not restricted to read-only merely because they joined by link. |
Invite, accept, resend, or revoke
Open People for workspace membership or the project's Team controls for project access
You need invitation-management permission.
Enter the email, choose the intended role and project access, then send the invite
Check the selected workspace/project before sharing it.
The recipient opens the invitation and completes the requested sign-in/acceptance
Confirm that the member appears with the intended role.
For a pending invitation, use the available resend/revoke action
If expired, issue a fresh invitation rather than asking the person to reuse the old link.
Change a member's role or remove them when their responsibilities change
Revoke any independent device, diagnostic, API-key, or MCP grant that must also end.
Integration and diagnostic access
Project integration scope is separate from the role. Full allows the supported provider-linked workflow and Claron context; Provider only limits the integration-facing path; None prevents that member's integration actions. Owners, developers, and testers can be eligible for Full; clients/guests should not be described as staff.
Backend evidence also needs diagnostic permission and recovery/trusted-device access. An invitation alone does not distribute the project's recovery password.
Use the minimum role/scope that meets the task and check a representative report with the intended visibility before relying on the access arrangement.