🤖 Explain with AI

Team Management¶

Collaborate with team members through workspaces with role-based access control, invitation workflows, and data isolation.

Overview¶

Team Management provides:

• Workspaces — Isolated environments for team collaboration
• Roles — Admin and Guest permissions
• Invitations — Email-based team member invitations
• Workspace Isolation — Data scoped per workspace
• Role-Based Access — Different permissions per role

Workspaces¶

What is a Workspace?¶

A workspace is an isolated environment where team members collaborate. Every user belongs to exactly one workspace.

Workspace Creation¶

When a new user signs up:

1. They automatically become the admin of their own workspace
2. Their user_id becomes the workspace_id
3. They can invite other team members to join

Data Isolation¶

All data in the platform is scoped to the workspace:

• AI agents and their configurations
• Voice agents and call logs
• Payroll employees and settings
• Perks and transactions
• Workflows and executions
• Assets and licenses

Roles¶

Admin Role¶

Full management privileges:

Guest Role¶

Read-only access:

Role Enforcement¶

Role-based access is enforced at multiple levels:

1. UI Level — Buttons and forms are hidden/disabled for guests
2. API Level — Edge functions verify admin role for write operations
3. Database Level — Row-Level Security (RLS) policies enforce permissions

Inviting Team Members¶

Sending Invitations¶

1. Navigate to Settings → Team
2. Enter the team member’s email address
3. Select a role (Admin or Guest)
4. Click Send Invitation

Invitation Process¶

1. Admin sends invitation → Edge function creates pending record
2. Email sent → Invited user receives invitation email
3. User signs up → If new user, they create an account
4. Invitation accepted → User joins the workspace with the assigned role

Invitation Status¶

Re-Inviting¶

If a pending invitation needs to be resent:

1. The old pending record is deleted
2. A new invitation is created
3. A fresh email is sent

Managing Team Members¶

Viewing Members¶

1. Navigate to Settings → Team
2. View the list of active and pending members

Changing Roles¶

1. Find the team member in the list
2. Click the role dropdown
3. Select the new role

Removing Members¶

1. Find the team member in the list
2. Click the delete icon
3. Confirm the removal

Safety Rules¶

Last Admin Protection¶

• Cannot demote the last admin
• Cannot remove the last admin
• System ensures at least one admin exists

Self-Protection¶

• Cannot change your own role
• Cannot remove yourself from the workspace
• Prevents accidental lockout

Email Verification¶

• Invitation email must match the user’s account email
• Prevents unauthorized workspace access
• Ensures proper identity verification

No Privilege Escalation¶

• Role is never modified during invitation acceptance
• Prevents invited users from granting themselves admin
• Role is set only by existing admins

Accepting Invitations¶

Invitation Flow¶

1. User receives invitation email with a unique token
2. User clicks the link in the email
3. If not logged in, redirects to signup page
4. If logged in, verifies email matches invitation
5. User accepts the invitation
6. User is added to the workspace with the assigned role

Invitation Token¶

• Unique token generated for each invitation
• Token is valid for a limited time
• Token is verified against the user’s email

Team Context¶

The TeamProvider context provides:

Best Practices¶

1. Start with admin — The workspace creator should be an admin
2. Use guests for oversight — Guests can view data without modifying it
3. Limit admin count — Keep admin count to those who need full access
4. Regular audits — Review team member list periodically
5. Remove inactive members — Clean up members who no longer need access

What’s Next¶

• Settings — Configure workspace settings
• API Keys — Manage API access
• Workflows — Automate team-related tasks

Still questions? Ask on Discord or explore tutorials