---
topic: team
needs_human: An Owner or Admin changes roles and app access on the Members page.
---

[← Guide home](https://embarko.ai/docs)

# Teammates and roles

**On this page:** Roles, Access to each app, Steps, Limits, Errors, What to tell the person

> Plain words unless the person is a developer. Never invent a link, name or code. [Rules](https://embarko.ai/docs/prerequisites)

Everyone in a workspace has a role, and each Member has a level of access to each app. Together they decide what the person, and their "Just me" tokens, can do. An Owner or Admin sets them on the Members page; you cannot change them. When a reply says permission_denied, tell the person and stop.

**Done when:** The person knows who can change the role and where, and nothing was done another way.

**Roles**

- **Owner**: Everything, including billing, and the only role that can make or change Owners and Admins.
- **Admin**: Everything, including billing: apps, teammates, tokens, moving apps. Cannot change Owners or Admins.
- **Member**: Can use every app by default, with more access to the apps they are given it on. Can add new apps, and has Full access to the apps they added.
- **Billing**: Plan and billing only. No apps.

**Access to each app**

- **Can use**: Use the app, see its history, comment. Nothing on the live app changes.
- **Can edit**: Their AI (you) can make changes as a preview for someone with Full access to approve, and read logs. The live app does not change until then. Previews are not available yet, so today you cannot deploy for them: tell the person who has Full access.
- **Full access**: Approve and publish to the live app, restore a version, change settings, secrets and domains, share, delete or move it.

**Steps**

1. To add a teammate, the person opens https://embarko.ai/app/members, clicks Invite, and enters an email, a role and, for a Member, their access: every app at one level, or only chosen apps. Only an Owner or Admin can invite people.
2. The teammate gets an email and has that access as soon as they sign in.
3. To let a Member's AI change one app: on the same page, give them "Can edit" (changes wait for approval) or "Full access" (they publish) on that app.
4. To change someone's role or access later, the person does it on the same page. Only an Owner or Admin can.
5. If a reply says permission_denied, tell the person in one message (say_to_user.no_permission). Do not retry, use other tools, make a new token, or deploy under another name to get round it.

**Limits**

- You cannot change roles or app access; the person does it on the Members page.
- A "Just me" token can do exactly what its person can, in every workspace they are in.
- A "Whole workspace" token is not limited by a role, and only an Owner or Admin can make one.
- Publishing a change to the live app needs Full access to it. A Member with less gets permission_denied when you deploy; nothing is published.
- Everyone who was in a workspace before roles existed is an Admin, and whoever made the workspace is its Owner. Someone added later without a role starts as a Member.

**Errors**

| Code | Status | Retry | What to do |
| --- | --- | --- | --- |
| `permission_denied` | 403 | No | The person who made this token is not allowed to do this. The reply names the permission and their access to the app (or their role). Nothing changed. Tell the person (say_to_user.no_permission); do not try another way round it. |

**What to tell the person**

- no_permission: "Your access ({your access to the app, or your role}) doesn't let me {what it was}. An Owner or Admin can give you more on the Members page: https://embarko.ai/app/members"

**Next:** Send the person to the Members page with what to change.

**Related:** [claim](https://embarko.ai/docs/claim) · [errors](https://embarko.ai/docs/errors)

---

[Guide home](https://embarko.ai/docs) · JSON: add .json