# Members & roles

> Invite teammates, assign the smallest useful role, and manage workspace ownership and access.

Source: https://docs.agentbeam.com/agent-cli/members

Workspace roles determine which data and actions a teammate can access. Open **Members** to review memberships and invitations. Current membership is checked by the server; hiding or showing a navigation item is not the authorization boundary.

## Choose the right role

| Role             | Main responsibilities                                                      | MDM access                                       |
| ---------------- | -------------------------------------------------------------------------- | ------------------------------------------------ |
| Owner            | Full workspace control, including ownership transfer                       | Read and operate when the MDM feature is enabled |
| Administrator    | Manage team, settings, policies, devices, and subscription                 | Read and operate                                 |
| Security manager | Investigate activity, review risks, manage policies and registered devices | Read-only                                        |
| Auditor          | Inspect security activity and export administrative audit                  | Read-only                                        |
| Billing          | View subscription and workspace usage                                      | None                                             |
| Member           | Connect personal devices and view workspace information                    | None                                             |

Owners and administrators manage [App monitoring](https://docs.agentbeam.com/agent-cli/app-monitoring): its settings, apps and their tokens, and [rules](https://docs.agentbeam.com/agent-cli/app-monitoring#rules) that ignore or quiet findings. Other roles with activity access see its findings and rules, and members can ask an admin to set it up. They also manage [Integrations and alert workflows](https://docs.agentbeam.com/agent-cli/integrations). Every change is checked on the server and audit-logged. Owners and administrators can export audit data; auditors can export it too. Security managers can read the audit log but do not have export permission. MDM additionally requires its independent beta feature grant.

## Invite a teammate

Use the Members invitation form with the intended email and permitted role. Share the generated private invitation link with its intended recipient using your approved channel. Treat the link as a credential. Members don't take a [seat](https://docs.agentbeam.com/agent-cli/subscription#who-takes-a-seat) until they connect a device; on Free, members plus pending invitations are capped at 10.

Allowed invitation domains are managed in **Workspace**. An empty restriction permits any domain. Tightening restrictions preserves existing members but revokes pending invitations outside the new boundary.

## Change a role

An owner can manage role assignment. Administrators cannot assign or modify owner/administrator privileges through ordinary role changes; they manage lower-privilege roles. Use the ownership-transfer workflow when handing over the workspace rather than trying to remove the last owner. An owner's own activity, devices, skills and usage stay hidden from other roles until an owner chooses to [share it](https://docs.agentbeam.com/agent-cli/workspace-settings#owner-privacy).

Review the practical effect before changing roles: a security manager can change agent policy and registered devices but cannot send MDM actions; an auditor can export audit history but cannot review risks.

## Remove access

Coordinate membership removal with device revocation and local offboarding. Check active device identities under **Agents** and verify remote revocation. Removing a browser session or uninstalling a CLI package does not by itself document all workspace access changes.

Consult the administrative audit trail after invitations, role changes, ownership transfer, and revocation. Preserve required evidence before deleting local data on a departing employee's device.

## Platform administration is separate

Workspace ownership does not confer Beam platform staff access. Internal administration is deployment-controlled and separate from customer workspace roles. Use workspace roles for your organization, and contact Beam for hosted setup actions that require platform operations.