Manage users, roles, workspaces and your account

Roles

Four roles cover the workspace. An owner can do everything, including billing and deleting the organization's access. An admin manages the team and the settings pages. An editor creates and edits records, including passports and documents. A viewer reads everything and writes nothing - write attempts are refused by the API guard, not just hidden in the interface.

Custom roles

When the four roles are too broad, define a custom role under Settings, Custom roles: for each area - products and passports, documents and evidence, suppliers and custody, compliance analyses, dashboard and analytics, regulations, integrations, administration - choose no access, view, or view and change. Then assign it to a member in Team settings.

A custom role only takes rights away. The member's base role still decides what they may do at all, so an editor with a custom role granting "view and change" on suppliers can change suppliers, while a viewer with the same custom role still cannot. The console hides the destinations a role refuses, the API refuses them with the role named, and an API key created by that member is bound by the same permission. A role in use cannot be deleted, so removing a role never quietly widens anyone's access.

The user directory

Users lists the members of the organization with their role and status, and each profile shows what that person can do. Use it before changing a role, and review it periodically - access that is no longer needed is the cheapest risk to remove.

Inviting and removing

Invitations are created in Team settings and consume a seat, so the plan's seat limit applies at the moment you invite rather than at some later surprise. Role changes take effect for the next request.

The last active owner cannot be removed or demoted. Assign another active owner first, otherwise the organization would become unadministrable.

Workspaces

A workspace separates a brand or business line inside one organization: products can be assigned to a workspace, and counts are reported per workspace. Workspaces are plan-capped, so a small plan cannot fragment a portfolio indefinitely.

A workspace can also be a boundary. In Team settings, an owner or administrator can limit a member to one or more workspaces: that member then sees and works on the products and passports of those workspaces only - lists are filtered, a record from another workspace answers as if it did not exist, and everything organization-wide (documents, suppliers, analytics, imports, bulk actions, settings) is refused. This suits an agency or a brand team. Members who are not limited see every workspace.

Your account and organization profile

My account shows your profile, your memberships and your effective permissions - the quickest way to answer 'why can I not see this page'.

The organization profile holds the display name, tagline, logo, colours, support link and default locale that the public passport renders, plus the notification address used for digests. Branding is validated on save, so an invalid colour or a non-secure logo link is refused rather than silently dropped.

Screen-by-screen reference

These pages were checked in the organization console on 8 October 2026 using an isolated sample organization. Controls can differ by role, plan, record state and configured providers. Each page below explains its purpose, a practical workflow, the visible controls and what to verify afterward.

My account (/account)

This page shows the signed-in identity, current organization, base role, plan and derived workspace permissions.

Check this view first when an expected button is missing. The displayed base role is only one part of access: an assigned custom role, workspace restriction, plan limit, or record state can also remove an action. Confirm the active organization in the sidebar before asking an administrator to change access.

A custom role or workspace restriction can narrow the base role shown here.

Controls and options

• Confirm the email and organization before working in a shared browser.
• View team directory opens user profiles; Admin dashboard appears only for managing roles.
• Client dashboard returns to the portfolio overview.
• Use the organization switcher in navigation when your account belongs to more than one organization.

Users and access (/users)

The directory lists members and summarizes what owner, admin, editor and viewer roles can do.

Use the directory to check who belongs to the current organization and which base role they hold. Open a member profile when a task assignment or permission seems inconsistent. Invitations and role changes are managed in Team settings, where seat limits and effective restrictions are visible.

The current plan can cap the number of seats.

Controls and options

• Open a member to inspect profile and permissions.
• Invite user goes to Team settings where seats and roles are managed.
• Use the role guide when deciding who should edit records or administer access.

User profile (/users/[id])

A member profile displays identity, organization role and the capabilities derived from it.

Read the member's displayed capabilities before assigning work that needs edit or administrative rights. If access is insufficient, an authorized administrator can adjust the base role or restrictions through Team settings. Return to the directory to compare members without assuming two people with the same base role have identical workspace access.

An additional custom role or workspace assignment can further restrict access.

Controls and options

• Read What this role can do before assigning work.
• Manage role opens Team settings for an authorized administrator.
• Back to users returns to the directory.

Workspaces (/workspaces)

Workspaces organize product records and can limit a member's view to selected parts of the organization.

Create a workspace to group product records within the same organization and then assign the relevant members from Team settings. A workspace label can help distinguish brands or teams, but it is not another tenant. Check affected members and records before renaming or deleting a workspace so access does not become confusing.

A workspace is an organizational boundary inside one tenant, not a separate organization.

Controls and options

• Create workspace with a name and optional brand label.
• Select an existing workspace to edit its name or brand; Save workspace records the change.
• Delete removes an eligible workspace only after confirmation.
• Assign a member to workspaces from Team settings; check the effective access shown there.

Team and organization (/settings/team)

Team settings combines the organization profile, white-label public passport appearance, invitations and membership access.

Keep the organization profile and public passport branding separate from membership decisions. Review the sitemap checkbox carefully because it makes the published catalogue enumerable; then save profile changes and inspect the public presentation. For access, invite an email with a base role, confirm a free seat, and apply custom role or workspace restrictions on the member row.

The sole owner is protected from removal or unsafe demotion.

Controls and options

• Update name, notification email, display name, tagline, HTTPS logo, colors, support URL and default language; Save profile applies them.
• The public sitemap checkbox makes published passports enumerable by search engines; review that choice before enabling it.
• Invite a teammate by email and base role, then Send invitation; the plan must have a free seat.
• Use each member row to change role, apply a custom role or workspace restriction, or Remove access where policy permits.

Custom roles (/settings/roles)

Custom roles narrow a member's base role by area, using none, view, or view and change.

Design a custom role by starting from the member's base role and narrowing each area to none, view, or view and change. Test the intended access against actual workflows before assigning it in Team settings. When revising or deleting a role, check existing assignees so a change does not unexpectedly remove their access.

A custom role never grants permissions beyond the member's base role.

Controls and options

• Name and describe a role, then set access for products, evidence, suppliers, analyses, dashboard, regulations, integrations and administration.
• Save role creates the restriction; assign it to a member on Team settings.
• Edit or remove a role only after checking who uses it; an in-use role cannot be deleted.

Operational digests (/settings/notifications)

Digest settings control email summaries of due evidence, supplier requests and lease handovers.

Choose digest frequency, recipient list, and expiry horizon to match who acts on upcoming evidence and supplier work. Preview the current digest before enabling delivery so irrelevant categories or missing recipients are caught. Send now is an actual delivery attempt; inspect status afterward instead of assuming the message reached every recipient.

Previewing does not send a message.

Controls and options

• Choose Off, daily or weekly frequency and extra recipients.
• Set the document expiry horizon and include the operational categories your team needs.
• Save settings stores the schedule; Preview digest lets you inspect the current content.
• Send now issues an on-demand digest when delivery is configured; inspect Delivery status for the result.