Roles
Understand the workspace roles used to protect settings and work.
Workspace roles set the broad access boundary. Team privacy and resource-level rules can narrow that access further.
| Capability | Admin | Member | Guest |
|---|---|---|---|
| Create and update normal work | Yes | Yes | No |
| Comment where access allows | Yes | Yes | Yes |
| Join available public teams | Yes | Yes | No |
| Manage members and roles | Yes | No | No |
| Configure workspace settings | Yes | No | No |
| Install workspace integrations | Yes | No | No |
| Manage workspace service accounts and webhooks | Yes | No | No |
Role intent
- Admin manages workspace policy, people, integrations, billing, and shared configuration. Keep the number of admins small, but have enough for continuity.
- Member creates and collaborates on work without changing workspace-wide security or administration.
- Guest is a limited collaborator. Guests can read and comment only where access has been granted, and cannot mutate normal work.
Changing a role does not automatically add someone to a private team. Likewise, a team membership does not grant workspace administration. FortyOne checks both boundaries when an action is performed.