Roles and permissions

Every capability a workspace Admin or Member holds, what each of the four project roles can do, and why a page can report not found.

There are two roles at workspace level and four inside a project, and one rule joins them: workspace membership opens no project on its own. This page lists every capability each role holds. It does not cover what a plan includes, or what anything costs.

The two workspace roles

Admin holds every workspace capability; Member holds none of them. There is no third role and no partial one: a member's work happens entirely inside the projects they have been added to.

Capability	Admin	Member
See the list of members and outstanding invitations	Yes	No
Invite someone, change their role, remove them	Yes	No
Change workspace settings, including the name and logo	Yes	No
Open Billing: the plan, the seat position and the invoices	Yes	No
Change the plan, the seat count and the payment method	Yes	No
See how much the workspace has spent this period	Yes	No
See every member's spend, not only their own	Yes	No
Create a project	Yes	No
Lead every project without being added to one	Yes	No
Export the workspace, or schedule it for deletion	Yes	No

A member who opens a workspace-level page does not meet a disabled button: Billing is not in their settings rail at all, and the members list refuses them. Creating a project is an Admin capability because it commits the whole workspace to a plan allowance, which is not a member's decision to spend.

The four project roles

Project roles are cumulative: each one holds everything the row below it holds, plus its own line. They are set per project, on the project's own Members table.

Capability	Lead	Editor	Commenter	Viewer
Read the project's evidence, themes, findings and briefs	Yes	Yes	Yes	Yes
Comment, react and vote	Yes	Yes	Yes	No
Edit briefs and other content, including the roadmap and transcripts	Yes	Yes	No	No
Add, sync and delete the project's sources	Yes	Yes	No	No
Use Chat, including Investigate	Yes	Yes	No	No
Add and remove the project's members	Yes	No	No	No
Change project settings	Yes	No	No	No
Delete the project	Yes	No	No	No

Using Chat spends the workspace's tokens, which is why it sits with the two editing roles rather than with reading.

How the two levels meet

A workspace Admin is a Lead on every project without appearing on any project's members table. That is one capability from the first table, not a membership row, so an admin cannot be removed from a project and never shows up in its list.

The reverse does not hold. A Member can be a project Lead — running a project outright, adding people to it and deleting it — while holding nothing at workspace level. Role at one level says nothing about role at the other.

Rules the interface does not show

Three refusals happen on the server, with no greyed-out control to warn you first.

Rule	What you see
A workspace keeps at least one Admin	The last admin cannot be made a Member or removed, and the attempt is refused
Nobody changes their own membership	Your own row carries no actions menu, and Remove from organization on your own page is refused
A source or a brief belongs to one project	Reaching one from a project you are not on fails as though it were not there

Why a page says not found rather than refused

A workspace or project you are not a member of reports not found, not not allowed, on purpose: an error that distinguishes the two would confirm that the thing exists. Refusals split three ways.

What happened	What comes back
You are not signed in	`401` — sign in and try again
You are signed in, and your role does not hold the capability	`403` — ask an Admin, or a project Lead
The thing is in another workspace, or in a project you are not on	`404` — existence is never confirmed

So a 404 on a link a colleague sent you usually means you are not on that project, rather than that the page has gone.

Manage members and roles — change someone's workspace role, or take their access away.
Add people to a project — give a member one of the four project roles.
Invite your team — bring someone into the workspace in the first place.
Security and data — what those roles can reach, and where it is kept.