Members & Roles
Add, view, and revoke members at account or workspace scope with ReBAC roles.
Members & Roles controls who can access your account and workspaces. Permissions are enforced by SpiceDB ReBAC — roles map to actions like read, write, administer, and manage_members.
Who can access
| Action | Required permission |
|---|---|
| View members | read on the scope |
| Add a member | manage_members on the scope |
| Revoke a member | manage_members on the scope |
Prerequisites
- Signed in with access to at least one account or workspace
manage_memberson the scope where you want to add or remove people
Available roles
| Role | Typical use | Account | Workspace |
|---|---|---|---|
| Owner | Full control | ✅ | ✅ |
| Admin | Manage resources and members | ✅ | ✅ |
| Writer | Read + write data, no admin | ✅ | ✅ |
| Member | Read-only member | ✅ | ✅ |
| Partner | Read-only external collaborator | ✅ | ✅ |
| Billing admin | Billing visibility | ✅ | — |
Actual permissions are enforced per-action (read, write, delete, ddl, deploy, manage_members, view_billing) — not by role name alone.
View members
Open Members & Roles
In the sidebar under Administer, click Members & Roles.
Choose a scope
Use the Scope selector to pick Account or Workspace, then select the specific account or workspace from the dropdown.
Review the table
The table shows each member's User ID, Email, Role, and Added date.
Add a member
Click Add member
With the correct scope selected, click Add member.
Enter user ID and role
Provide the user's Portal user ID (from Keycloak sub or Settings page) and select a role. For account scope, billing admin is available.
Confirm
The new member appears in the table and gains ReBAC permissions immediately.
Email-based invite flows are operator-driven in production (POST /v1/admin/accounts with owner email). The portal add-member flow uses an existing user ID.
Revoke a member
Click the Remove (trash) icon on a member row. Confirm in the dialog. Revocation is immediate and audited.
Troubleshooting
| Problem | Likely cause | What to do |
|---|---|---|
| Add member button missing | No manage_members | Ask an owner or admin |
| User not found | User hasn't signed in yet | User must exist in Keycloak; operator can pre-provision |
| Member still has access after revoke | SpiceDB eventual consistency | Wait a few seconds; check Activity Log |
Related API
GET /v1/scopes/{scope_type}/{scope_id}/members— list membersPOST /v1/scopes/{scope_type}/{scope_id}/members— add memberDELETE /v1/memberships/{membership_id}— revoke
See Core concepts for the ReBAC action vocabulary.