Members & Roles
Platform membership on accounts and workspaces — separate from app end-user roles under Authentication.
Members & Roles controls which portal users can access your account and workspaces. Permissions are enforced by SpiceDB ReBAC — roles map to actions like read, write, administer, and manage_members.
These are platform membership roles (Customer Portal / Control Plane). They are not the roles your app's end users get under Authentication. See ReBAC model for the three role planes.
Who can access
| Action | Required permission |
|---|---|
| View members | read on the scope |
| Add a member | manage_members on the scope |
| Revoke a member | manage_members on the scope |
Prerequisites
- Signed in with access to at least one account or workspace
manage_memberson the scope where you want to add or remove people
Platform roles
| Role | Typical use | Account | Workspace |
|---|---|---|---|
| Owner | Full control | ✅ | ✅ |
| Admin | Manage resources and members | ✅ | ✅ |
| Writer | Read + write data, no full admin | ✅ | ✅ |
| Member | Read-only member | ✅ | ✅ |
| Partner | Read-only external collaborator | ✅ | ✅ |
| Billing admin | Billing visibility / account administer | ✅ | — |
Effective access is enforced per-action (read, write, delete, ddl, deploy, manage_members, view_billing) — not by role name alone.
Environment deployer is a separate SpiceDB relation for deploy targets (often covered by workspace administer). It is not selected on this page — see ReBAC model.
View members
Open Members & Roles
In the sidebar under Administer, click Members & Roles.
Choose a scope
Use the Scope selector to pick Account or Workspace, then select the specific account or workspace from the dropdown.
Review the table
The table shows each member's User ID, Email, Role, and Added date.
Add a member
Click Add member
With the correct scope selected, click Add member.
Enter user ID and role
Provide the user's Portal user ID (from IdPlane sub or Settings page) and select a role. For account scope, billing admin is available.
Confirm
The new member appears in the table and gains ReBAC permissions immediately.
Email-based invite flows are operator-driven in production (POST /v1/admin/accounts with owner email). The portal add-member flow uses an existing user ID.
Revoke a member
Click the Remove (trash) icon on a member row. Confirm in the dialog. Revocation is immediate and audited.
App end-user roles
To invite users who sign into your Shell or product app (not the Customer Portal), use Administer → Authentication. Those roles and permission packs live in the workspace IdP and do not grant portal API access.
Troubleshooting
| Problem | Likely cause | What to do |
|---|---|---|
| Add member button missing | No manage_members | Ask an owner or admin |
| User not found | User hasn't signed in yet | User must exist in IdPlane; operator can pre-provision |
| Member still has access after revoke | SpiceDB eventual consistency | Wait a few seconds; check Activity Log |
| Confused with app login roles | Wrong plane | Use Authentication for end users |
Related API
GET /v1/scopes/{scope_type}/{scope_id}/members— list membersPOST /v1/scopes/{scope_type}/{scope_id}/members— add memberDELETE /v1/memberships/{membership_id}— revoke
See Memberships API and ReBAC model.