> ## Documentation Index
> Fetch the complete documentation index at: https://docs.platform.nora.my/llms.txt
> Use this file to discover all available pages before exploring further.

# Members & roles

> Invite people to the workspace, assign roles, and manage access.

Workspaces are collaborative. Add teammates, give them roles, and they can build, run, and monitor together — with the guardrails their role allows.

## Roles

Nora has three built-in roles:

| Role        | Can do                                                                          |
| ----------- | ------------------------------------------------------------------------------- |
| **Owner**   | Everything. Billing, plan changes, deleting the workspace, adding other Owners. |
| **Manager** | Everything except billing and workspace deletion. Publishes and rollbacks.      |
| **Member**  | Build in Draft, run Flows, view Traces. Cannot publish, cannot change settings. |

**Viewer** (read-only) exists on Team and Enterprise plans — can see Flows and Traces but cannot edit.

Every action in the app is tied to a role check. If a button is grayed out, you're one role short.

## Inviting

Settings → Members → **Invite**.

Fields:

* **Email** (required).
* **Role** — Member by default. Owners and Managers can invite Managers and Members. Only Owners can invite Owners.
* **Optional message** — appears in the invitation email.

The invitee gets an email with a signup link. Sign-in with the same email confirms the invitation.

Bulk invite: paste multiple emails, choose a single role for all.

## Managing an existing member

Settings → Members → click a member. Options:

* **Change role** — up or down. Owners can be demoted only by another Owner.
* **Reset session** — logs the member out of every device (they'll sign in again).
* **Remove** — revokes access immediately. Their content stays; their name shows in audit logs as "former member".

## The last Owner

A workspace must have at least one Owner. Attempting to remove the last Owner (or demote them) is refused with a clear error. Add a co-Owner first.

## Invitations that never land

If someone doesn't receive the invitation email:

* Check spam.
* Confirm the email you typed exactly matches their sign-in email.
* Resend from Settings → Members → Pending → **Resend**.

Pending invitations expire after 14 days. Resend to extend.

## SSO-managed workspaces

For Enterprise workspaces with SSO enabled:

* Members are provisioned via SCIM (or your IdP's mapping).
* Local invites are disabled — the workspace roster mirrors your IdP.
* Role mapping is configured in Settings → Security → SSO.

## Groups (Enterprise)

Group members into named groups:

* **Support team** — members involved with the support Flow.
* **On-call** — the escalation group for approval webhooks.
* **Approvers** — allowed to decide approvals.

Groups can be granted per-Flow permissions (see [Access](/settings/workspace/access)) or referenced by external systems via the API.

## Audit

Every membership change is logged (see [Audit trail](/reliable/versions/audit)):

* Invites sent.
* Roles changed.
* Members removed.
* SSO provisioning events.

Exportable for compliance reviews.

## Removed member — what happens to their content

* Flows they authored stay.
* Datasets they authored stay.
* Feedback they submitted stays (attributed to "former member").
* Their personal access tokens (issued via `auth login`) are revoked immediately.

Content ownership doesn't transfer — items still belong to the workspace, not to individuals.

## Contact info

For account issues (login problems, forgotten workspace) unrelated to a specific member, email [support@conscience.technology](mailto:support@conscience.technology).