Tutorial

Invite your team

Getting roles right early saves you from re-auditing access later. Here's how invitations and roles actually work.

Steps

  1. 1

    Open Settings → Members

    You'll see everyone currently in the workspace, plus any pending invitations.

  2. 2

    Send an invite

    Enter an email and pick a role. The invitee gets a magic link — no password to set up before their first login.

  3. 3

    Adjust roles as the team grows

    Roles can be changed at any time from the same screen. A role change takes effect on the member's next request — there's no re-login required.

The built-in roles

  • Tenant Admin — full access, including billing and member management
  • Manager — day-to-day operational access across assigned modules
  • Staff — data entry within assigned modules, no settings access
  • Auditor — read-only across every module, including financial statements and audit logs
Roles aren’t just hidden UI. Every permission check also runs as a row-level security policy in Postgres, so a Staff account calling the API directly is blocked at the database, the same as in the browser.
Multi-tenancy & security →Back to introduction →