Users and roles
Each active Workspace membership has one role: owner, administrator, or developer. The role applies to the complete Workspace.
Each active Workspace has exactly one owner. The owner has administrator access and can also transfer ownership or schedule recoverable Workspace deletion.
Ownership transfer requires recent authentication, explicit confirmation, and an active administrator as the new owner. The previous owner becomes an administrator in the same operation.
Administrator
Section titled “Administrator”Administrators manage users, billing, connections, repository monitoring, and other product settings allowed by the Workspace’s plan.
The service prevents a Workspace from losing its required administration coverage. Hiding an action in the interface is not an authorization control; the server checks every operation.
Developer
Section titled “Developer”Developers can view Workspace product data and run repository, on-demand, Customer API, CLI, MCP, and The Captain scans. They cannot manage users, billing, connections, repository monitoring, policy, or Workspace settings.
Removing or suspending a Workspace membership takes effect immediately for browser sessions, Personal API Tokens, MCP, the CLI, and The Captain’s tools.
Membership state
Section titled “Membership state”Only active memberships authorize access. Invitations remain pending until the verified recipient signs in and explicitly accepts them in the Control Plane. Suspended or removed memberships retain required audit history but cannot read or change Workspace data.
Owners and administrators can invite people by email, resend a pending invitation, or revoke it before acceptance. The verified invitation email must match the account that accepts it.
Ownership and deletion
Section titled “Ownership and deletion”The owner can transfer ownership to an active administrator after recent authentication and explicit confirmation. The previous owner becomes an administrator in the same operation.
Workspace deletion is recoverable during its scheduled deletion window. Scheduling or cancelling deletion requires owner authorization and explicit confirmation. Product data remains isolated to that Workspace throughout the lifecycle.