# Members and roles

> Invite people to an AI CodeOps workspace, choose built-in roles from owner to viewer, create custom roles on Enterprise, and require two-factor sign-in.

Source: https://aicodeops.dev/docs/members

A workspace holds your projects, sessions and settings. Everyone in it has a role, and the role decides what they can see and do. Every change to members and roles is recorded in **Measure → Audit Log**.

## Built-in roles

| Role      | What it can do                                                                                          |
| --------- | ------------------------------------------------------------------------------------------------------- |
| Owner     | Full access, including making other owners.                                                             |
| Admin     | Full access, except making owners or changing an owner's role.                                          |
| Developer | Runs AI sessions; manages projects, agents, schedules, deployments and incidents; manages own API keys. |
| Member    | Runs AI sessions; manages deployments, incidents and decision records; manages own API keys.            |
| Viewer    | Read-only. Can't run sessions or create API keys.                                                       |

There are also separation-of-duties roles for larger teams:

| Role           | What it can do                                                                                                                  |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| Security Admin | Policies, audit and approvals. No billing or secrets.                                                                           |
| DevOps Admin   | Projects, runbooks, schedules, deployments and incidents. No billing, members or secrets, and can't change models or providers. |
| Billing Admin  | Billing, budgets and usage. No access to code, secrets or members.                                                              |
| Secret Manager | Workspace secrets only.                                                                                                         |

Every plan offers all of these roles. SSO isn't part of any workspace role: it belongs to your organization's owners and admins. See [Single sign-on](https://aicodeops.dev/docs/sso).

### Rules for assigning roles

- You can't give anyone a role at or above your own level, or change the role of someone at or above it.
- Only an owner can assign administrative roles (any role that can change settings, assign roles or create roles).
- A workspace must keep an owner. To hand over ownership, make another member an owner, then step down.

## Invite people

1. Open **Configure → Members** and choose **Invite Member**.
2. Enter their email address and choose a role.
3. They get an email. When they sign in or sign up with that same address, they join the workspace.

If the email can't be sent, you'll see "Invited, but no email could be sent." Ask them to sign up with the invited address; they join when they do.

Organization admins can also invite from **Configure → Settings → Organization & Teams**. That sends an invitation link you can copy and share. The link expires after 7 days, must be accepted with the email address it was sent to, and can be revoked under **Pending Invitations** before it is used. You can send up to 30 invitations a minute.

## Remove a member

On **Configure → Members**, choose **Delete** on the member's row and confirm **Remove member**. Their workspace access and their API keys are revoked at once. You can't remove yourself, someone at or above your level, or the last owner.

## Custom roles

On Enterprise, owners and admins can create custom roles under **Configure → Settings → Roles & Permissions**. Give the role a name and a slug, then pick permissions from groups such as Workspace, Members, API Keys, Models & Providers, Projects & Operations, Governance & Secrets, Usage & Billing, Sessions and Security.

- You can't grant permissions you don't hold yourself.
- Only an owner can edit a role that has administrative permissions, or add them to an existing role.
- A role that is still assigned can't be deleted. Reassign its members first.

## Two-factor authentication

Each person sets up two-factor sign-in from **Configure → Settings → Multi-Factor Authentication**: an authenticator app (TOTP) or a passkey (hardware key, fingerprint or Face ID). Ten recovery codes are issued when you add your first factor.

Two-factor sign-in is required for owners and admins, and for any role with sensitive permissions such as managing secrets, providers, SSO, policies, members or billing. Depending on your plan, developers and members may be required to enroll too. Anyone who must enroll is asked to before they continue.

## Next steps

- [Single sign-on](https://aicodeops.dev/docs/sso)
- [Approvals and policies](https://aicodeops.dev/docs/approvals-and-policies)
- [API keys](https://aicodeops.dev/docs/api)

## Frequently asked questions

### Can an admin make someone else an admin?

No. Only an owner can assign administrative roles. Everyone else can only assign roles below their own level.

### What happens to a removed member's API keys?

They are revoked when the member is removed, along with the member's access to the workspace.