People and roles — Docs

How people join your organization, the organization and workspace roles, and private workspaces.

Access is set at two levels: your organization (who's in the company account and who administers it) and each workspace (who can see and change its data). Manage both under Settings.

Organization roles

Role	Can
Member	Use the workspaces they have access to
Admin	Also invite people, manage workspaces and access, and see query activity and usage
Owner	Also make or remove owners, and change sign-in and SSO settings

Workspace roles

Role	Can
Viewer	Run queries, ask questions, and use models and published tabs
Editor	Also manage connections, sync settings and models
Admin	Also manage who has access to the workspace, and delete connections

To give someone access, open Settings → Workspace access and choose Add someone.

Shared and private workspaces

In a shared workspace, every member of the organization is at least a viewer, and organization owners and admins are workspace admins.
A private workspace is only open to people granted access explicitly. Organization admins can see that it exists and can delete it, but they can't read its data unless they've been granted access.

Joining an organization

Under Settings → Domains & SSO, choose how people join:

Policy	What happens
Anyone with a verified company domain joins automatically	The default. Someone who signs up with an address at your domain joins your organization.
Verified domain, but an admin must approve	They can request to join, and an admin approves them.
Invitation only	Only people who've been invited can join.

People who join automatically are given the Editor role in the default workspace.

Verifying your domain

A domain only routes people into your organization once you've proved you own it. Datachef gives you a DNS TXT record to add:

Name	Value
`_datachef.<your domain>`	`datachef-verification=<token>`

Until the domain is verified, signing up with an address at that domain doesn't put anyone in your organization. Public email domains such as gmail.com never route anyone anywhere.

Invitations

Owners and admins can invite anyone, including contractors with addresses outside your domain, from Settings → People. An invitation gives a role of Member or Admin (or Owner, when an owner sends it) and expires after 14 days.