Team and roles
Invite your team to an organization or workspace, and choose what each person can do.
Your team are the people who build and run things on Groundfloor: they sign in to the Client Portal and the gf CLI. Each person has a role in your organization, and in each workspace they work in. Manage both on the Team page.
These aren't your app's users. People who sign in to your apps are managed in App authentication.
Roles
In an organization
An organization has six roles.
| Role | Can |
|---|---|
| Owner | Everything, including members, workspaces, billing and deleting the organization. Only an Owner can make someone an Owner |
| Admin | Manage members, workspaces, apps and billing, and rename the organization. An Admin can't make anyone an Owner, remove an Owner or another Admin, or delete the organization |
| Billing admin | Billing only: the Billing card, billing statements and the billing contact. Can see the organization and who is in it, but can't change members and has no access to any workspace |
| Writer, Member, Partner | View the organization and its workspaces. Use Partner for people from outside your company |
In a workspace
A workspace has five roles.
| Role | Can |
|---|---|
| Owner | Everything in the workspace, including members and deleting it |
| Admin | Manage members, create and delete collections and workload identities, change the workspace's structure, and everything a Writer can do |
| Writer | Create, edit and deploy: Coderunners, apps, data, files, secrets and flags. A Writer can't manage members or create collections |
| Member, Partner | View only |
What people inherit
Organization roles carry down into the organization's workspaces, so someone can have more access than their workspace role alone shows:
- An organization Owner or Admin has Admin access in every workspace in the organization, without being added to each one.
- An organization Writer, Member or Partner can view every workspace in the organization.
- A Billing admin gets nothing in the workspaces.
- A workspace role only adds access inside that workspace. It doesn't give any access to the organization or to other workspaces.
To give someone access to one workspace only, don't make them an organization Owner or Admin. Add them to the organization as a Member or Partner and give them a role in that workspace.
You can't give anyone a role higher than your own. When you pick a role, the Client Portal shows what it allows.
Add someone
Open Team
In the Client Portal sidebar, click Team. Use Scope to choose the organization or the workspace you're adding them to.
Invite or add them
| Option | Use it when | Email sent |
|---|---|---|
| Invite member | They should set their own password | Yes, with a link to set a password |
| Add member | You want them to sign in now, with a password you set | Optional: Send email with invitation details is on by default. The email never contains the password |
Enter their work email and a role. With Add member, also set a password of at least 8 characters, and tick Require password change on first sign-in so it's only temporary.
They're in
Someone who already has a Groundfloor login gets the role straight away. Someone new appears as Pending until they sign in and click Accept on the invitation banner; until then the role grants nothing.
To add people to an organization you need the Owner or Admin role in it. To add people to a workspace you need Owner or Admin in that workspace, or in its organization. A Billing admin or Writer sees the organization's list but can't change it.
Team lists only your team. People who sign in to your apps are managed under App authentication and never appear here.
Change a role or remove someone
- Change a role: pick a new one in the person's Role column.
- Remove someone: click the trash icon on their row and confirm. Access ends straight away, and the change is recorded in the activity log.
Your own password
Change it under Settings → Password.
Troubleshooting
| Problem | Likely cause | What to do |
|---|---|---|
| No Invite member button | Your role can't manage members | Ask an Owner or Admin |
| The invitation email never arrives | The email wasn't sent; the Client Portal says so after you invite | Use Add member with a temporary password, or contact support |
| Inviting is blocked because "this organization's identity group is linked to another account" | The organization's sign-in setup is shared with another organization. It's not caused by the email you entered | Contact support and give your organization's ID (where to find it) |
| Add member fails for an email | That person already has a Groundfloor login | Use Invite member instead |
| You can't choose a role | It's higher than your own | Ask someone with a higher role |
| A new member can't do anything | Their invitation is still Pending | Ask them to sign in and click Accept |
Next steps
- App authentication — let your app's users sign in.
- Memberships API — manage your team from code.