Roles and permissions
Everyone in a workspace has one of four roles. The same roles apply to projects: a project role, when someone has one, takes precedence over their workspace role inside that project.
| Role | In short |
|---|---|
| Owner | Full control, including ownership. |
| Admin | Manages members and content, but cannot transfer ownership. |
| Analyst | Can load data and create content, but cannot manage members. |
| Read only | Can view content only, with no editing rights. |
Each role can do everything the roles below it can. In the app, View role permissions shows this summary. An action your role does not allow is greyed out with Your role doesn’t allow this action. The same rules apply to an AI assistant acting for you.
The Workspace Insights project is the exception: only the Owner and Admins see it, and nobody can change it, whatever their role.
Where: Workspaces page → a workspace card’s More actions (⋯) menu → Add members → View role permissions. The link sits below the invite form and opens a side panel; every page that invites members (see below) has it.
What each role can do
| Action | Read only | Analyst | Admin | Owner |
|---|---|---|---|---|
| View the workspace, its projects, plan and monthly report | ✓ | ✓ | ✓ | ✓ |
| View sources, tables, results tables and their SQL; run queries | ✓ | ✓ | ✓ | ✓ |
| Download results tables (CSV) | ✓ | ✓ | ✓ | ✓ |
| View dashboards (within each dashboard’s visibility) | ✓ | ✓ | ✓ | ✓ |
| View presentations and open their generated PDFs (within each presentation’s minimum role) | ✓ | ✓ | ✓ | ✓ |
| View refresh history | ✓ | ✓ | ✓ | ✓ |
| View alerts and their history (Alerts in the sidebar) | ✓ | ✓ | ✓ | ✓ |
| Use the agent in the app (each action it takes needs its own role) | ✓ | ✓ | ✓ | ✓ |
| Add, edit and delete sources; upload files | ✓ | ✓ | ✓ | |
| Create, edit, duplicate and delete results tables, and confirm a SQL change that breaks what reads them | ✓ | ✓ | ✓ | |
| Create and edit dashboards, and restore an earlier version | ✓ | ✓ | ✓ | |
| Create, edit and render presentations, and restore an earlier version | ✓ | ✓ | ✓ | |
| Create, edit, dry-run, run and pause alerts | ✓ | ✓ | ✓ | |
| Edit project knowledge | ✓ | ✓ | ✓ | |
| Delete dashboards; set who can view a dashboard | ✓ | ✓ | ||
| Delete presentations | ✓ | ✓ | ||
| Set the brand presentations print in, or take it from your website (through an AI assistant) | ✓ | ✓ | ||
| Remove alerts | ✓ | ✓ | ||
| Refresh sources now; set up scheduled refreshes (Cron Refresh) | ✓ | ✓ | ||
| Fix a processed table’s cleanup query | ✓ | ✓ | ||
| Create projects | ✓ | ✓ | ||
| Invite and remove members; change roles (below Owner) | ✓ | ✓ | ||
| Edit workspace knowledge and settings; manage monthly report delivery and controls | ✓ | ✓ | ||
| Manage billing and the plan | ✓ | ✓ | ||
| Data Shares, Data Egress, Audit Logs, Credits | ✓ | ✓ | ||
| Manage private connections | ✓ | ✓ | ||
| Delete a project or the workspace; make someone Owner | ✓ |
Inviting members
Admins and Owners invite people from Add members — on the workspace card, the Projects page, or a project card for project-only access.
Where: Workspaces page → a workspace card’s More actions (⋯) menu → Add members; or Add members at the top right of the Projects page. For project-only access: Projects page → a project card’s ⋯ menu (top right of the card) → Add Members. On the Projects page both are greyed out for roles that cannot manage members. The page that opens lists current members first, with the invite form below.
- Enter the person’s Email and choose a Role: Admin, Analyst or Read only. Ownership cannot be granted in an invitation; an Owner can promote someone later.
- Click Add.
- If the person already has a Teramot account, they are added right away.
- Otherwise they receive an invitation email and join automatically when they create a Teramot account with that same email address. Signing up with a different address leaves the invitation pending.
- Someone invited to the workspace also gets access to every project in it.
- Pending invitations show a Pending badge; an Admin can Cancel invitation.
If the invitation goes beyond the seats your plan includes, the app asks you to confirm a billed seat — see Plans and limits. Someone who already belongs to another Free workspace, its free trial ended or not, cannot be added to a Free one: there is one per person.
Changing roles and removing members
Where: the member list at the top of the workspace’s Add Members page or the project’s Project Members page, reached as in Inviting members. Change a role with the role dropdown on the member’s row; remove someone with the trash icon on the row, then Remove. A member you cannot change shows their role as a badge instead. For a pending invitation, the trash icon on its row leads to Cancel invitation.
- Owners can change or remove anyone. Admins can change or remove Analysts and Read only members.
- Only an Owner can make someone Owner or change an Owner’s role.
- A workspace always keeps at least one Owner.
- Removing a member takes effect immediately.
Leaving
Where: Workspaces page → a workspace card’s More actions (⋯) menu → Leave workspace; or Projects page → a project card’s ⋯ menu → Leave project.
Anyone can leave a workspace or project from its card (Leave workspace, Leave project).
- If you are the last Owner, you pick a New owner first.
- If you are the last person in a workspace, leaving deletes the workspace and every project in it, permanently.
- If you are the last person with access to a project, leaving deletes that project; the workspace stays.