Roles
Five roles, each with an explicit list of what it may do. Nothing is inherited by seniority, so there is no surprise about what an administrator can reach.
| Role | Can do |
|---|---|
| Owner | Full control, including billing, ownership transfer and deleting the workspace. |
| Administrator | Manage people, mail accounts, integrations, templates and settings. |
| Manager | Manage assigned mail accounts, templates and follow-ups; view analytics. |
| Member | Read and send from mail accounts they are assigned to. |
| Read-only | View only. Cannot send, edit or change settings. |
Sensitive actions — connecting a mailbox, changing security settings, issuing an API token — ask for the member's password again even when they are already signed in.
Working on a thread together
- Assignment. Give a conversation an owner so two people do not answer it twice.
- Internal notes. Discussion attached to the thread that is never sent to the customer.
- Presence and activity. See who has the thread open and what has been done to it.
- Live updates. New mail and changes appear without a refresh where the realtime service is enabled.
Joining and leaving
- Invitations are single-use links that expire, sent to a specific address.
- Removing a member ends their sessions and their access to the workspace's mail immediately.
- A member can belong to several workspaces and switch between them; nothing is shared across the boundary.
- The workspace activity log records sign-ins, invitations, mailbox changes and security events, and members can read it themselves.
Isolation between workspaces
Every query, background job, cache entry, file path and realtime channel is scoped to one
workspace. It is not a filter that a forgotten where clause can defeat: the
scope is applied by default and code that tries to read tenant data without a workspace
context fails rather than returning everything. See
security and privacy.