Roles and permissions
What the owner, admins and members of a workspace can see and do.
Every member of a workspace has one of three roles. Each workspace has exactly one owner. The person who creates a workspace is its first owner. To change roles or transfer ownership, see Members and roles.
What each role can do
| Action | Owner | Admin | Member |
|---|---|---|---|
| See the list of members | Yes | Yes | Yes |
| Invite people, and see and cancel pending invites | Yes | Yes | No |
| Remove members (anyone except the owner) | Yes | Yes | No |
| Change a member’s role between Member and Admin | Yes | No | No |
| Transfer ownership | Yes | No | No |
| Delete the workspace | Yes | No | No |
| Change the workspace’s AI and phishing detection rules | Yes | Yes | See only |
| Change the workspace’s logo and color | Yes | Yes | See only |
| Add their own mailboxes, calendars and drives | Yes | Yes | Yes |
| Mark a resource Shared or Private | Yes | Yes | No |
| Remove a resource they connected from the workspace | Yes | Yes | Yes |
| Remove a resource someone else connected | Yes | Yes | No |
| Choose which calendars and drive folders the workspace shows | Any account | Any account | Only accounts they connected |
Who can see each resource
| Resource is marked | Owner | Admin | Member |
|---|---|---|---|
| Shared | Yes | Yes | Yes |
| Private | Yes | Yes | Only if they connected it |
Private means only the person who connected the resource and the workspace’s owners and admins can see it.
Settings only the person who connected a resource can change
Whatever their role, only the person who connected a mailbox, calendar or drive can turn AI on or off for it (the robot icon on its row), or phishing detection for a mailbox (the shield icon). Everyone else sees whether it is on. The workspace’s own AI and privacy settings can still turn these features off, or require phishing detection.
Changes that need your authenticator code
These actions ask for a code from your authenticator app before they take effect:
- Making a member an admin (the owner).
- Transferring ownership (the owner).
- Deleting the workspace (the owner).
- Changing the workspace’s AI or phishing detection rules (owners and admins).
- Turning AI or phishing detection on for a resource (the person who connected it).
Turning AI or phishing detection off for a resource, and changing an admin back to a member, need no code.