Four roles, fourteen permissions.

The four roles

• Owner: every workspace action, billing, ownership transfer and deletion. A workspace has exactly one.
• Admin: workspace settings, projects, invitations and API keys.
• Member: projects, tasks and the assistant.
• Billing: the subscription and invoices, with basic access to the workspace.

The permissions

The template grants fourteen permissions: workspace.read, workspace.update, workspace.delete, projects.read, projects.write, members.invite, members.remove, roles.manage, billing.read, billing.manage, keys.manage, audit.read, ai.read and ai.apply.

Changing the matrix

The owner edits the matrix on the roles page and saves it after a summary of what changes. The owner's own column is locked, and roles.manage and workspace.delete stay with the owner whatever the matrix says. Every change is written to the activity log.

The assistant follows the same rules

The workspace assistant reads only what the person's role can read. When it proposes a change, such as new tasks, nothing happens until the person applies it, and the API checks their permission again at that moment.