A staff member's workspace role controls the actions they can take. Company access controls the customer records they can reach. Choose both when inviting someone or reviewing their access.

Built-in roles

Core has fixed workspace roles. The Role Permissions and Role Comparison tabs in Settings > Permissions show their current permissions. Use those views for exact access rather than treating the roles as a single ladder: billing roles have different responsibilities from delivery roles.

Role	Typical use
Owner	Workspace administration and Core subscription management
Super Admin	Broad administration, including integrations
Admin	Staff administration and day-to-day operations
Manager	Team workload, assignments, project resourcing, and reporting
Technician	Customer work, tickets, assets, knowledge, and time tracking
Member	Basic record visibility, project-task work, knowledge contributions, and own time
Observer	Read access to operational records and own time tracking
Billing Administrator	Contract and billing operations, ticket work, reports, and all staff time
Billing (Read-only)	Read and export billing-related data, view all staff time, and track own time

Team membership roles, project membership roles, and reporting-manager relationships are separate from the workspace role. They can affect management scope within their area; they do not replace the workspace permissions.

Assign or change a role

For a new staff member, open Settings > Members, enter their invitation details, choose a role, and select Invite.

For an existing member:

Open their profile from Team members or their dashboard from Teams.
Find Role & Permissions.
Choose the new role and select Update Role.

Only authorized administrators can change workspace roles. The role picker and server enforce which users and roles they can manage. Pending invitees can have their role updated before they accept.

You can invite someone, or resend an invitation, only when its role is at or below your own. Only Owners can invite Owners or Super Admins or resend their invitations.

Admin access alerts

Core emails a security alert to the workspace's active Owners, Super Admins, and Admins when someone:

is invited as an Owner, Super Admin, or Admin, or has a pending admin invitation resent
is promoted into one of those roles, including from Admin to Super Admin or Owner
has their account activated or reactivated while holding one of those roles

The email names the person and their role, who made the change, and when it happened in UTC, and links to Settings > Members so you can review it. The person who received access isn't emailed. The person who made the change isn't emailed either, unless they are the workspace's only active administrator.

Invitations and role changes for any other role, including Billing Admin and Manager, don't send this alert, and neither does lowering an administrator's role. You can't unsubscribe from these security emails.

You can inspect users by role in Settings > Permissions > Users & Roles. This page is an access reference; it does not create custom roles or edit role-permission mappings.

Understanding permission names

Permissions describe actions in a particular area. Read, create, update, delete, assign, and export are separate permissions where supported.

Permission	Access
`tickets:read`	Read accessible tickets
`tickets:create`	Create tickets
`tickets:update`	Update ticket details
`tickets:assign`	Assign tickets
`customers:read`	Read accessible companies
`customers:update`	Edit companies
`assets:update`	Edit assets
`time_tracking:own`	Track and manage own time
`time_tracking:view_team`	Review permitted team time
`time_tracking:view_all`	Review staff time across the workspace

Some features also check ownership, managed-team scope, company access, or separate financial grants. A permission to read a record is not permission to edit it.

Company Access

Owners, Super Admins, and Admins can choose which companies a workspace member can access from Settings > Members. Their role still controls what they can do within those companies.

Assigned reporting managers can also manage their direct reports' company access from the same page. They can grant only companies they can access themselves. A manager with selected-company access cannot grant All companies. If a report already has broader access, an administrator must handle the change. Only administrators can assign reporting managers; the Manager role or team leadership alone does not grant this authority.

All companies is the default for existing members and new invitations. It includes companies added later.
Selected companies grants access only to the companies you choose. New companies must be added explicitly. An empty selection grants no access to company records.
Owner, Super Admin, and Admin accounts always retain access to all companies.

Tickets follow their company even when no project has been linked. Projects, contacts, assets, and related records follow the same company restrictions. Restricted members can access files attached through Core's supported ticket file paths; other shared files are unavailable. Personal internal projects remain available to their owner. Recent items list only tickets, assets, and projects the member can still access. Items from a removed company drop off the list. Assigning someone to a ticket or project does not grant access to its company.

Choose company access when inviting a member, or click the company access button beside an existing member. Restrictions are saved before an invitation is sent, and apply to subsequent requests from existing sessions. Stop any running timer for a company before removing that company from a member's access.

Previously downloaded content cannot be recalled. Temporary file links, including newly issued links, can remain usable after company access is removed. These links normally last one hour, or up to 48 hours for customer notes; cached copies may remain available longer.

Workspace-wide tools that cannot safely enforce company restrictions are unavailable to restricted members. This includes the AI assistant, agent connections, financial reporting, shared knowledge, forms, meetings, and broader administration. Customer portal users, including Helpdesk Admins, keep their existing company access rules.

Review access

Before assigning a broad role, compare its permissions with the person's responsibilities. Use selected-company access when someone should work with only a defined customer list. Review roles, company selections, and reporting managers when a person changes jobs.

Use the offboarding workflow when someone leaves; it removes access and lets you reassign their active work. See Team Management.

Permissions & Roles