# Roles and access

Decide what each person in the workspace can see and change.

Every member has one **role**, a named set of permissions. The built-in roles cover most teams; owners and admins can also create **custom roles** in **Settings › Roles**, and add **extra permissions** to one person without changing their role.

| Role | Can |
| --- | --- |
| **Owner** | Everything, including transferring the workspace. There's always at least one. |
| **Admin** | Manage members, roles, keys and companies. Can't transfer the workspace. |
| **Member** | Work with companies, and create personal tokens for their own scripts. |

You can only give permissions you hold yourself, so nobody can grant more than they have.

## When someone leaves

Remove them from **Team**. They lose access right away, including through AI agents they connected; the companies and history they added stay with the workspace.

To hand the workspace over, an owner uses **Settings › Transfer ownership**: the new owner is confirmed with a code sent by email, and the previous owner becomes an admin.