Workspace roles

A Workspace Role controls a user's permissions within one workspace. The roles are owner, admin, and member, defined in packages/authz/src/roles.ts. A user's role can differ between workspaces.

Role	Permissions
Owner	Full workspace control, including deletion and data export
Admin	Workspace management, excluding deletion and data export
Member	Workspace content, roster, notifications, and assistant reads; no token, webhook, audit-log, or SSO configuration access

Routes name permissions such as apiToken:create and call the shared authorize() guard. Loaders omit unreadable sections, UI controls explain unavailable actions, and server functions check permissions again.

API Token scopes use the same permission statements. Their read scope includes security metadata that a member's browser session cannot read, because owners and admins choose the scopes when issuing a token. See API tokens.

System Admin is a separate account-level role. It grants no workspace-membership bypass. See System admin.