Members and permissions
The admin and member roles, the nine permissions an admin can grant on paid plans, assistant access and how permissions apply to API and MCP connections.
Roles
| Role | Can do |
|---|---|
| Admin | Everything, including billing, members, permissions, tags and API keys. |
| Member | Work with knowledge and assistants within the permissions an admin gave them. A member never manages billing or members. |
Invite people with the workspace join link, which an admin creates in the team settings. Anyone with an active link can join until it expires. Removing a member ends their access at once, including their API and MCP connections.
The Free plan
On the Free plan, every member has every permission and sees every assistant. The plan has one seat.
Permissions on paid plans
On a paid plan, an admin chooses what each member can do. A member with no permission set can do nothing until an admin grants some. Open the Permissions page to set them.
| Permission | Lets the member |
|---|---|
resources_list | View the list of resources, their content, the tag list and the pages of a site. |
resources_create | Create resources. |
resources_edit | Edit resources, re-index them and sync sites. |
resources_delete | Delete resources. |
assistants_create | Create assistants. |
assistants_edit | Edit the assistants they can access, and their widgets. |
assistants_delete | Delete the assistants they can access, and their widgets. |
api | Use the REST API and the CLI. |
mcp | Use Lookio from an MCP client. |
An admin also chooses which assistants each member can use: a list, or all of them including future ones. A member can only ask, edit or delete the assistants on their list.
Asking questions needs no separate permission. If a member can use an assistant, they can ask it, and the credits come from the workspace.
Permissions take effect immediately, on connections too. A right removed in the app is gone from the member’s CLI login and MCP clients on their next call.
Permissions and the API
A person who connects the CLI or an MCP client acts with their own permissions. On a paid plan they need the api permission for REST and the CLI, and mcp for MCP clients. The scopes their permissions make useless are dropped from the connection, so an AI client is never offered a tool it would only see refused.
An API key is different. It is a workspace credential created by an admin, with its own scopes. It does not follow a member’s permissions and never manages members or tags. See API keys.
What members may hand to AI clients
Separately from their permissions, an admin can cap what members may grant to an AI client or a CLI login of their own, in the API access settings. The cap bounds what a member can delegate, never what they can do in the app. It does not apply to workspace API keys, and admins are not limited by it. An admin can also set an exception for one person.
Manage members from the API
Listing members and changing their permissions are admin-only calls that need a personal connection with the admin scope: List members and Change a member’s permissions. Changing permissions needs a paid plan.