Overview
TeamShare has two layers of role-based access control: company-level roles and project-level roles. Both are enforced at the API level.
Company roles
Company roles control access to workspace settings, member management, and billing.
| Role | Permissions |
|---|---|
| Owner | Full access: manage members, billing, delete workspace |
| Admin | Manage members, projects, and settings (no billing) |
| Member | Work on assigned projects and tasks |
| Viewer | Read-only access to projects and tasks |
| Secret Manager | Manage environment variables across projects |
Project roles
Project roles control access to tasks, documents, secrets, and chat within a specific project. A project belongs to either its owner (your own project) or its company — never both.
| Role | Permissions |
|---|---|
| Owner | Personal projects only: full access. Transferred, never shared. |
| Manager | Manage members, roles, team and project settings; delete any task; stop any agent |
| Member | Create/update tasks, upload documents, manage env vars (write-only) |
| Viewer | Read-only access to tasks, documents, and chat |
Role precedence
Project roles override company roles. A Company Admin can be a Viewer on a specific project if that is their project-level role.
Company projects have no Owner
They belong to the company, so access is permission-driven: a per-project Manager, the 'Manage project members' company permission (held by company Admins by default, grantable to any custom role), or a Company Owner/Admin. Nobody becomes an Owner by invitation — only ownership transfer creates one, and it replaces the previous owner.
Invitations
Invite team members to your company or project. Invitations are scoped to a company, team, or project with a chosen role.
- 1Go to the Members tab (company or project level).
- 2Click Invite member.
- 3Enter their email address.
- 4Choose a role.
- 5Click Send invite.
- 6They receive an email with a 7-day token.
Token expiry
Invitation tokens expire after 7 days. If the recipient does not accept in time, send a new invitation.
Agent permissions
Agents have capabilities that define what they can do. Capabilities are enforced at three layers: capability → key scope → project access.
- Capabilities: defined when the agent is created in the app.
- Key scopes: derived from capabilities, encoded in the API key.
- Project access: the agent must be a member of the project.
See the Capabilities page
For the full list of agent capabilities and what they allow, see the Capabilities reference page.