---
title: "Members and permissions"
description: "The admin and member roles, the nine permissions an admin can grant on the Pro and Custom plans, assistant access and how permissions apply to API and MCP connections."
canonical: "https://lookio.app/docs/guides/members-and-permissions"
updated: "2026-11-08"
---

# Members and permissions

## Roles

| Role       | Can do                                                                                                                     |
| ---------- | -------------------------------------------------------------------------------------------------------------------------- |
| **Admin**  | Everything, including billing, members, permissions, tags and API keys.                                                    |
| **Member** | Work with knowledge and assistants, within the permissions that an admin gives. A member never manages billing or members. |

To invite people, an admin creates a join link in the team settings. Anyone with the link can join until it expires. When you remove a member, their access stops at once, with their API and MCP connections.

![The Team page: three members with their roles, an Invite link card and the API scopes by member](/docs/images/app/team.webp)

_Team: the members, their roles, and the invite link._

## The Free and Starter plans

On the Free and Starter plans, every member has every permission and sees every assistant. Free has one seat, Starter has unlimited seats.

## Permissions on the Pro and Custom plans

On these plans, an admin sets what each member can do, on the **Permissions** page. A member without permissions can do nothing.

| Permission          | Lets the member                                                                  |
| ------------------- | -------------------------------------------------------------------------------- |
| `resources_list`    | View the list of resources, their content, the tag list and the pages of a site. |
| `resources_create`  | Create resources.                                                                |
| `resources_edit`    | Edit resources, re-index them and sync sites.                                    |
| `resources_delete`  | Delete resources.                                                                |
| `assistants_create` | Create assistants.                                                               |
| `assistants_edit`   | Edit the assistants they can access, and their widgets.                          |
| `assistants_delete` | Delete the assistants they can access, and their widgets.                        |
| `api`               | Use the REST API and the CLI.                                                    |
| `mcp`               | Use Lookio from an MCP client.                                                   |

An admin also sets **which assistants** each member can use: a list, or all of them, future ones too. A member can ask, edit or delete only the assistants on their list.

To ask questions, a member needs no separate permission. If they can use an assistant, they can ask it. The workspace pays.

A change applies at once, also to connections. A permission removed in the app stops on the member's next CLI or MCP call.

> **Note**
>
> Permissions are not per query mode and there is no per-member budget. Credits are shared by the workspace.

## Permissions and the API

A person who connects the CLI or an MCP client has their own permissions. On the Pro and Custom plans, they need `api` for the REST API and the CLI, and `mcp` for MCP clients. Lookio removes the scopes that their permissions do not allow. So an AI client never gets a tool that would always be refused.

An API key is different. An admin creates it for the workspace, with its own scopes. It does not follow a member's permissions. It never manages members or tags. See [API keys](/docs/guides/api-keys).

## What members may hand to AI clients

An admin can limit what members may give to an AI client or to their CLI login, in the API access settings. This limit applies only to what a member delegates, not to what they do in the app. It does not apply to API keys or to admins. An admin can set an exception for one person.

## Manage members from the API

Only admins can list members or change their permissions, with a personal connection that has the `admin` scope. See [List members](/docs/api/members/list-members) and [Change a member's permissions](/docs/api/members/update-member-permissions). Permissions need the Pro or Custom plan.