Users & Access
Every user in your workspace has up to four independent settings that control access. They are independent because they answer four different questions.
| Question | The setting | Where to change it |
|---|---|---|
| Can this user administer the workspace? | Access Level | Settings → Users |
| What can this user do inside projects? | Role | Settings → Users |
| Which projects can this user see? | The project’s access default, and any exception naming them | Settings → Projects → Manage access… |
| Should this user have different permissions in one specific project? | A per-person exception set to a specific role | Settings → Projects → Manage access… |
A quick analogy
Think of it like a job at a large company. Your Role is your job title — it describes what work you are qualified to do. Your Access Level is your security badge — it controls which floors of the building you can enter. A badge does not change your job skills, and your job skills do not change which floors you can access. They are set independently.
Users & access has four tabs
All user and access management lives on one page, Users & access. Each tab is also its own entry in the Settings sidebar, and each carries a live count:
- Users — view all workspace members, change their Access Level or Role, invite new users
- Access groups — create and manage reusable groups of users for project access
- Roles & permissions — create and edit custom Roles and their permission sets
- Invitations — track invitations you have sent, and resend or cancel them
The seat limit. Each plan includes a number of active users — 5 on Free, 10 on Starter, 40 on Pro. When every seat is in use, Invite on Users and on Invitations stays in place but is disabled, a resend in an invitation’s menu is disabled with the reason, and a note under the panel heading names the plan that lifts the limit, with Upgrade for a billing admin or Ask for anyone else. Over the limit after a downgrade, everyone keeps access; only inviting is blocked until the workspace is under it. Deactivating someone frees a seat. See Plans and Billing.
Explore each concept
Access Levels
Controls which workspace groups appear in Settings, and tenant-wide permissions. Three levels: Regular User, Project Admin, Tenant Admin.
Roles
Custom named roles that define what a user can do inside projects. Applies across all projects by default.
Project Access & Overrides
The workspace-wide default on each project, and the exceptions that give one person or group something else.
Access Groups
Reusable collections of users, so one project exception can cover a whole team. Not roles — groups have no permissions of their own.
Common scenarios
- I want to make someone an admin who can manage users and roles.
- Change their Access Level to Tenant Admin. See Access Levels.
- I want to restrict what someone can do in projects (e.g., view-only).
- Change their Role to one with limited permissions. See Roles.
- I want to give someone a specific role in one project.
- Open that project from Settings → Projects, choose Manage access…, add them as an exception and set it to A specific role. Note that this does not restrict them elsewhere — everyone can open every project on its default terms unless an exception says otherwise. See Project Access & Overrides.
- I want to treat a whole team differently on several projects.
- Create an Access Group, add the users, then add that group as an exception on each project. See Access Groups.