Team and roles

Dashboard members administer Workforce. Each member holds one role, a flat set of permissions. Employee tool access is separate; see Groups and access.

Signing in to the Workforce console requires Manage workforce or View workforce. Among built-in roles, only Admin has either.

Invite a member

Open Settings → Organization and click Invite team member.
Enter their email, pick a role, and click Send invitation.

Requires Manage users. Invitations expire after 7 days; manage them on the Pending tab. With SSO or SCIM, members arrive through your identity provider instead.

Built-in roles

Built-in roles can’t be edited or deleted.

Role	What it grants
Admin	Every permission
Developer	Manage Connectors, Tool Packs, security rules and alerts, webhooks, and workflows. View API keys, credentials, skills, logs, and the Audit trail
Security	Manage security rules, alerts, users, roles, credentials, API keys, and SCIM. View Connectors, Tool Packs, skills, and logs
Read-only	View permissions only. Not the Playground, billing, or Workforce
Non-Admin	Their own connections, credentials, skills, logs, alerts, and access requests, plus the tool catalog

Permissions required for each action

To do this	You need
Sign in to the Workforce console	Manage workforce, or View workforce
Configure SSO	Manage users
Generate a SCIM token, and set default or Group access	Manage users, or Manage SCIM
Grant a Connector or Tool Pack to a Group or an employee	Manage users, or Manage SCIM
Set a Group’s routing policy, approved models, or budget	Manage workforce
Create, rotate, or revoke API keys	Manage organization API keys
Create or edit a custom role	Manage roles
Edit security rules and resolve violations	Manage security rules, Manage security alerts
Read tool call logs and the Audit trail	View logs, View audit trail

Create a custom role

Open Settings → Roles and click Add custom role.
Name the role and toggle permissions, then save.
Assign it from the member’s row in Settings → Organization.

Names must be unique. A role needs at least one permission. A role with members can’t be deleted.

Disable a member

In Settings → Organization, open the member’s overflow menu and click Disable account. They are logged out and nothing is deleted. Members from your identity provider are deprovisioned through SCIM instead.

Your organization must keep at least one active Admin.