> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.ovalbee.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.ovalbee.com/_mcp/server.

# Members and roles

Access in OvalBee is decided per workspace. Each member has one **role** in a workspace, and a flow can additionally be **shared** with specific people. Workspace owners and admins manage both under **Settings** → **Members**.

## Workspaces

Everything you build belongs to a workspace: flows, datasets, models, ontologies, secrets and API tokens. Nothing is visible across workspaces except the shared model catalog.

Every account gets a workspace of its own on first sign-in, and joins others by invitation. Switch between workspaces with the selector at the top of the main sidebar, where they're called *spaces*. The same menu has **Create Space**, and owners can rename or delete a workspace from it.

A common setup is one workspace per team or per customer project, so members, secrets and storage stay separate.

## Roles

| Role             | Can do                                                                                                                                                                                   |
| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Owner**        | Everything, including billing and making other members owners.                                                                                                                           |
| **Admin**        | Everything in the workspace except ownership and billing: members, secrets, tokens, flows and data.                                                                                      |
| **Developer**    | Build, edit and run flows, edit data, use secrets in nodes, and manage their own API tokens.                                                                                             |
| **Operator**     | View and run flows, share them with others, and view data. Can't change a flow's structure or settings.                                                                                  |
| **Viewer**       | View all flows and data. Can't edit or run anything.                                                                                                                                     |
| **Collaborator** | Only the flows explicitly shared with them, including the datasets, models and ontologies those flows show. The workspace's **Storage**, **Models** and **Ontologies** pages are hidden. |

Some typical assignments:

* ML engineers who build flows: **Developer**.
* Project leads who run established flows and hand them to others: **Operator**.
* Labelers and reviewers: **Collaborator** or **Viewer**. Labeling access comes from being assigned to a Labeling or Review stage, not from the role — a labeler doesn't need edit rights on the flow to work in the annotation tool.
* Stakeholders who follow results: **Viewer**.

Only an owner can make someone an owner. On plans without workspace roles, every member gets full access, and the role picker says so.

## Adding members

Click **Add member**, enter the person's email and choose a role. OvalBee emails them an invitation link, valid for seven days, that lets them create an account or join with the one they have. Pending invitations are listed with the members, where you can resend or cancel them.

Invitations need email to be configured on the installation. An instance administrator can also add an existing user directly by username, without an email.

To remove someone, use **Remove member** in their row. What they created stays in the workspace.

## Sharing a single flow

To give a person access to one flow without changing their role, open **Share...** from the flow's card on the Home page or from the editor's **More actions** menu, pick the member and a level:

* **Can view** — see the flow, its results and reports.
* **Can run** — also run its nodes.
* **Can edit** — also change it.

Sharing only adds access: it never takes away what someone's role already allows. You can share at most the access you have yourself. Owners, admins and operators can share flows, on plans that include workspace roles.

## Instance administrators

Instance administrators are a separate, installation-wide role. They manage user accounts — create, edit, deactivate, reset passwords — under **Admin** → **Configuration** → **People**, and can add anyone to any workspace. Being an instance administrator doesn't by itself make you a member of every workspace.

## Related pages

* [Sign-in and accounts](/administration/sign-in-and-accounts) — how people get accounts in the first place.
* [Secrets and API tokens](/administration/secrets-and-tokens) — what each role can do with credentials.
* [Audit log](/administration/audit-log) — the record of membership and access changes.