AdministrationPeople and access

Members and roles

Who belongs to a workspace, what each role can do, and how to give someone access to a single flow.

Access in OvalBee is decided per workspace. Each member has one role in a workspace, and a flow can additionally be shared with specific people. Workspace owners and admins manage both under Settings → Members.

Workspaces

Everything you build belongs to a workspace: flows, datasets, models, ontologies, secrets and API tokens. Nothing is visible across workspaces except the shared model catalog.

Every account gets a workspace of its own on first sign-in, and joins others by invitation. Switch between workspaces with the selector at the top of the main sidebar, where they’re called spaces. The same menu has Create Space, and owners can rename or delete a workspace from it.

A common setup is one workspace per team or per customer project, so members, secrets and storage stay separate.

Roles

RoleCan do
OwnerEverything, including billing and making other members owners.
AdminEverything in the workspace except ownership and billing: members, secrets, tokens, flows and data.
DeveloperBuild, edit and run flows, edit data, use secrets in nodes, and manage their own API tokens.
OperatorView and run flows, share them with others, and view data. Can’t change a flow’s structure or settings.
ViewerView all flows and data. Can’t edit or run anything.
CollaboratorOnly the flows explicitly shared with them, plus read access to the workspace’s data.

Some typical assignments:

  • ML engineers who build flows: Developer.
  • Project leads who run established flows and hand them to others: Operator.
  • Labelers and reviewers: Collaborator or Viewer. Labeling access comes from being assigned to a Labeling or Review stage, not from the role — a labeler doesn’t need edit rights on the flow to work in the annotation tool.
  • Stakeholders who follow results: Viewer.

Only an owner can make someone an owner. On plans without workspace roles, every member gets full access, and the role picker says so.

Adding members

Click Add member, enter the person’s email and choose a role. OvalBee emails them an invitation link, valid for seven days, that lets them create an account or join with the one they have. Pending invitations are listed with the members, where you can resend or cancel them.

Invitations need email to be configured on the installation. An instance administrator can also add an existing user directly by username, without an email.

To remove someone, use Remove member in their row. What they created stays in the workspace.

Sharing a single flow

To give a person access to one flow without changing their role, open Share… from the flow’s card on the Home page or from the editor’s More actions menu, pick the member and a level:

  • Can view — see the flow, its results and reports.
  • Can run — also run its nodes.
  • Can edit — also change it.

Sharing only adds access: it never takes away what someone’s role already allows. You can share at most the access you have yourself. Owners, admins and operators can share flows, on plans that include workspace roles.

Instance administrators

Instance administrators are a separate, installation-wide role. They manage user accounts — create, edit, deactivate, reset passwords — under Admin → Configuration → People, and can add anyone to any workspace. Being an instance administrator doesn’t by itself make you a member of every workspace.