---
title: Roles and permissions
description: What the owner, admins and members of a workspace can see and do.
---

Every member of a workspace has one of three roles. Each workspace has exactly one **owner**. The person who creates a workspace is its first owner. To change roles or transfer ownership, see [Members and roles](/guide/workspaces/members-and-roles).

## What each role can do

| Action | Owner | Admin | Member |
| --- | --- | --- | --- |
| See the list of members | Yes | Yes | Yes |
| Invite people, and see and cancel pending invites | Yes | Yes | No |
| Remove members (anyone except the owner) | Yes | Yes | No |
| Change a member's role between **Member** and **Admin** | Yes | No | No |
| Transfer ownership | Yes | No | No |
| Delete the workspace | Yes | No | No |
| Change the workspace's AI and phishing detection rules | Yes | Yes | See only |
| Change the workspace's logo and color | Yes | Yes | See only |
| Add their own mailboxes, calendars and drives | Yes | Yes | Yes |
| Mark a resource **Shared** or **Private** | Yes | Yes | No |
| Remove a resource they connected from the workspace | Yes | Yes | Yes |
| Remove a resource someone else connected | Yes | Yes | No |
| Choose which calendars and drive folders the workspace shows | Any account | Any account | Only accounts they connected |

## Who can see each resource

| Resource is marked | Owner | Admin | Member |
| --- | --- | --- | --- |
| **Shared** | Yes | Yes | Yes |
| **Private** | Yes | Yes | Only if they connected it |

**Private** means only the person who connected the resource and the workspace's owners and admins can see it.

## Settings only the person who connected a resource can change

Whatever their role, only the person who connected a mailbox, calendar or drive can turn AI on or off for it (the robot icon on its row), or phishing detection for a mailbox (the shield icon). Everyone else sees whether it is on. The workspace's own [AI and privacy settings](/guide/workspaces/ai-and-privacy) can still turn these features off, or require phishing detection.

## Changes that need your authenticator code

These actions ask for a code from your authenticator app before they take effect:

- Making a member an admin (the owner).
- Transferring ownership (the owner).
- Deleting the workspace (the owner).
- Changing the workspace's AI or phishing detection rules (owners and admins).
- Turning AI or phishing detection on for a resource (the person who connected it).

Turning AI or phishing detection off for a resource, and changing an admin back to a member, need no code.