Team & roles

A workspace is a shared space for your whole team. The Team page is where you decide who has access and what they can do. Syntrum uses four roles — Owner, Admin, Operator, and Viewer — that map cleanly onto how people actually work with a digital workforce: some own the blast radius, some write the rules, some operate inside them, and some just watch.

You reach it from the sidebar under Admin → Team.

The four roles#

Role	In one line
Owner	Full control, billing, and ownership. One person holds it (transferable).
Admin	Manages members, agents, tools, and workspace policy — but not billing or ownership.
Operator	Runs the workforce day to day: chat, approvals, start/stop. Can't change the rules.
Viewer	Read-only. Sees everything, changes nothing.

The guiding idea: Operators live inside the rules, Admins write the rules, and the Owner owns the consequences. Editing a policy is itself a privileged action — which is why it sits with Admins and above, not Operators.

The capability matrix#

This is exactly what each role can do. The dashboard mirrors it by disabling controls you don't have access to (with a "Requires Admin" style hint) rather than hiding them — so you can always see what's possible.

Capability	Owner	Admin	Operator	Viewer
View dashboards, agents, audit, reports	✅	✅	✅	✅
Resolve approvals (approve / deny / edit)	✅	✅	✅	❌
Chat with agents / enqueue tasks (Inbox)	✅	✅	✅	❌
Start / stop / restart / pause agents	✅	✅	✅	❌
Take over an agent (human-in-control)	✅	✅	✅	❌
Hire / configure / delete agents	✅	✅	❌	❌
Attach / detach tools, connect integrations	✅	✅	❌	❌
Edit safety & permission policies (all levels)	✅	✅	❌	❌
Invite / remove members, change roles	✅	✅ (below own role)	❌	❌
BYOK model keys, workspace rename	✅	✅	❌	❌
Billing, workspace deletion	✅	❌	❌	❌
Transfer ownership	✅	❌	❌	❌

These checks are enforced on the server, on every request — the UI's disabled buttons are a convenience, not the security boundary. A Viewer can't resolve an approval even by crafting the request directly.

An Admin can only manage roles below their own — they can promote and demote Operators and Viewers, and invite new ones, but can't touch other Admins or the Owner. Only the Owner can create or change an Admin, and only the Owner can hand over ownership.

Inviting a teammate#

Owners and Admins see the Invite a teammate panel at the top of the page.

Enter the person's email.
Choose their role with the role picker. Admins can assign Operator or Viewer; Owners can assign any role.
Click Invite.

What happens next depends on the email:

They already have a Syntrum account → they join the workspace instantly.
They don't yet → the invite is saved, and they join automatically the moment they sign up with that email.

Email invitations are still being rolled out. Today, an invite to a brand-new user doesn't send an email — the person joins when they sign up with the invited address. If you're waiting on someone, ask them to create an account with that exact email. See Troubleshooting.

Members and presence#

The Members list shows everyone with access. Each row has their name and email, when they joined, their role, and a presence indicator:

A green dot and "Online now" means they've been active in the last five minutes.
Otherwise you'll see "Active 2h ago" or "Never signed in."

Where available, a member's row also shows their last-7-days activity — approvals decided and guidance given — so you can see who's carrying the operational load.

Changing a role#

If you can manage a member, their row shows a role picker. Choose a new role from the dropdown; it saves immediately.

A role change takes effect on the member's next sign-in or workspace switch — not necessarily the instant you change it.

Removing a member#

Click the trash icon on an editable member's row to remove them from the workspace. They lose access immediately; their history in the audit log remains.

Pending invites#

Invites that haven't been accepted appear in a Pending invites section with the invited email, role, who invited them, and an expiry date. Owners and Admins can:

Resend — refresh the invite (and re-send the email once delivery is enabled), extending its validity.
Revoke — cancel the invite so it can no longer be used.

Transferring ownership#

Every workspace has exactly one Owner. To hand it over (Owner only):

On the target member's row, open the ⋮ menu and choose Transfer ownership.
Confirm in the dialog. In one atomic step, they become the Owner and you become an Admin.

The change is recorded in the audit log and takes effect on your next sign-in or workspace switch.

Ownership transfer is irreversible from your side — once someone else is Owner, only they can transfer it back. Be sure before you confirm.

What's next#

Workspace settings — rename the workspace, manage your profile, and more.
The three planes — how human roles combine with agent autonomy and tool permissions.
Billing — the Owner-only plan and payment controls.