Roles & permissions
Roles control what each person can do in a workspace, from asking questions to managing settings, billing, and members.
The roles
Full control of the workspace. The owner manages billing, buys top-up prompts, changes roles and removes members.
Runs the workspace day to day: adds, edits and archives connections, invites members, creates API keys, hides tables from members and switches AI apps on or off. An admin can read billing and invoices but cannot change the plan, change roles or remove members.
Asks questions and reads the workspace settings: usage, connections, their own Odoo access and their connected AI apps. A member cannot change them, and cannot see billing.
Can read conversations but cannot ask questions, and has no access to Settings or to Brief your assistant. Ask an admin to change the role to ask questions.
How roles affect access
Roles decide what you can manage, not just what you can see. For example, members and connections are managed by owners and admins, billing is managed by the owner only (an admin can read it), and viewers cannot ask questions or open Settings.
Private threads
Chat threads are private to their creator regardless of role. A higher role such as owner or admin does not grant access to another person's private thread. Access comes from creating the thread or being invited to it.
API keys and AI apps
An API key acts as a member of its workspace, with the member role, never as an owner or an admin. It is limited to the public API. An AI app you connect, such as Claude, answers as you: your role and your hidden tables apply. A viewer cannot ask through an AI app either.
Where roles are managed
Owners and admins invite members under Settings → Members. Only the owner changes a role or removes a member, and only an owner can invite a new owner. The workspace always keeps at least one owner.