User access rules
User access in a workspace is controlled by membership and roles, managed by owners and admins.
Where it is managed
Workspace members are managed under Settings → Members. Owners and admins can invite people by email and choose a role for each invitation. Only the owner can change the role of a member who has already joined, or remove a member.
Roles at a glance
Owner
Full control, including billing, roles and removing members. Only an owner can invite a new owner.
Full control, including billing, roles and removing members. Only an owner can invite a new owner.
Admin
Manages connections, invitations, API keys and table visibility, and can read billing. Cannot change roles or remove members.
Manages connections, invitations, API keys and table visibility, and can read billing. Cannot change roles or remove members.
Member
Asks questions and reads the workspace settings; cannot manage members.
Asks questions and reads the workspace settings; cannot manage members.
Viewer
Can read conversations but cannot ask questions, and cannot open Settings.
Can read conversations but cannot ask questions, and cannot open Settings.
The Core Concepts → Roles & permissions page covers what each role can do in more detail.
App roles vs database permissions
Workspace roles control what someone can do inside STYD. They do not change your database’s own permissions. Your database user’s privileges still apply, so keep using a read-only database user as your baseline.
Related controls
Table visibility (in the AI Guide) can further limit which tables specific members can use. It is set for each member, and every way of asking follows it: the chat, the API and AI apps. The Security section covers it in more depth.