> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cobalt.peoplereign.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles & team

> The roles that govern console access, and how to manage your team.

# Roles & team

Every administrator holds one or more **roles**. Roles are enforced on the
server, on every request — the UI also hides what you can't do, but the server is
the authority.

## Roles

| Role        | Can do                                                                                                             |
| ----------- | ------------------------------------------------------------------------------------------------------------------ |
| **Owner**   | Everything. The workspace creator; same powers as Admin, and can't be removed by others.                           |
| **Admin**   | Full control of agents, integrations, channels, team, and settings (including SSO and SCIM).                       |
| **Member**  | Read access to the console: agents, skillsets, and skills. No editing, and no team, billing, or security settings. |
| **Billing** | View invoices and usage, manage payment methods, buy credits. No agent or security access.                         |

A person can hold several roles at once (for example **Admin + Billing**); their
effective access is the union. Roles are additive — there's no "deny."

<Note>
  The **Billing** role is only relevant on plans where you manage your own
  billing; on enterprise-contract workspaces it's hidden.
</Note>

## Invite teammates

<Steps>
  <Step title="Open Settings → Team">
    You need the **Admin** or **Owner** role to invite or change members.
  </Step>

  <Step title="Enter emails and pick roles">
    Paste one or more email addresses and choose the role(s) to grant.
  </Step>

  <Step title="They accept the email invite">
    Each invitee gets a link, creates or signs in to their account, and lands in
    your workspace with the roles you assigned.
  </Step>
</Steps>

Pending invitations can be resent or revoked from the same screen.

## Change or remove members

* **Edit roles** — open a member and adjust their role set; changes take effect on
  their next request.
* **Remove** — revokes their access to the workspace. You can't remove yourself,
  and you can't remove the **last** Admin/Owner — a workspace must always have one.

## Letting your IdP assign roles

If you use [Enterprise SSO](/identity/sso), you can map your identity provider's
**groups** to Cobalt roles, so role assignment is governed by your directory
instead of by hand. See [Map groups to roles](/identity/sso#map-groups-to-roles).