Manage workspace access

Add an existing user to a workspace, review their effective access, or change the permissions a workspace role provides. These actions affect who can use and administer resources in that workspace.

Before you start

Select the correct workspace and confirm the access your organization has authorized. Workspace member and permission administration requires members.manage in that workspace. An administrator role name alone does not establish that you hold a particular permission.

Identity provisioning, organization-wide access and workspace membership are separate responsibilities. Adding a member here does not create an identity-provider account or send an invitation email.

Add a member

1. Open Administer → Workspaces and select the workspace. You can also open Administer → Access & org → Review workspace permissions to reach the selected workspace’s administration area.
2. In Members, select Add Member.
3. Search for the person’s name or email in User, then select the correct identity from the results. Entering text without selecting a result is not enough.
4. Choose the agreed Role. Review its permissions rather than assuming that roles form a hierarchy.
5. Select Add Member and check the resulting member row.

Expand the member row to inspect the effective permissions available to that person. Ask them to select the workspace and confirm the specific action they need. If their identity-provider claims changed, they may need to sign in again.

For an authorized service identity, use Service Account and the agreed Service Account Reference instead of selecting a person. This records membership; it does not create or rotate a credential.

Change or remove direct membership

In Members, change the person’s Role to update their direct workspace role. The selection is submitted immediately; there is no separate Save step. Check the displayed role and effective permissions after the change.

To remove a direct member, use the row’s removal action, check the identity in Remove member?, and confirm Remove. This removes that direct membership. The person may still have access through organization or namespace administration, another role, or another grant. Verify effective access if the purpose is to withdraw access completely.

Change a role’s workspace permissions

1. Open Permission Matrix on the workspace detail page.
2. Find the permission row and role column. Read the cell’s current state: granted by default, denied, granted by override, or removed by override.
3. Select the intended cell to apply a workspace override. The change is submitted immediately and affects users holding that role in this workspace.
4. Check the updated state and a representative user’s effective permissions.

Selecting an overridden cell again removes that override and returns to the role’s default for that permission. Platform permissions cannot be overridden here. Roles hold independent permission sets; a role with a broader name can lack a permission another role has.

Reset All Overrides removes all role-permission overrides in this workspace after confirmation. It can restore permissions previously removed as well as remove permissions previously added. Review the complete impact before using it; individual changes are safer when only one permission needs attention.

Organization and tenant administration

Use Administer → Access & org to open the organizations and namespaces available to you. The selected workspace determines the organization used by related administration pages. Follow your organization’s identity process for users who do not appear in the directory.

Tenant settings, when available to namespace administrators, controls features such as notifications, advanced notifications and identity-provider provisioning. Changes take effect when the switch is changed. Turning off notifications stops new notifications and suppresses queued deliveries; advanced notifications require notifications to be enabled. Read the scope shown before changing a setting. A shared organization can require an organization administrator instead.

Trusted-tenant setup, provisioning credentials and some identity-provider mappings require platform administration. Delegate those tasks to the identity or platform team. Technical identity reference covers those integration responsibilities.

If access is still wrong

For basic access questions, see Understand access and permissions. For assistant configuration, see Configure AI resources.