Seats and team access

Access is two separate decisions: the role, which says what someone can change, and workspace membership, which says whose data they can see.

What you'll learn

• The roles and what each can do
• How seats are counted against your plan
• The cleanup that gets forgotten when somebody leaves

Roles

Only an owner or an admin can invite, and that is enforced on the server rather than by hiding a button.

Workspace membership

A role on its own does not grant sight of client or brand data. Membership of a workspace does. Scope an invitation to a workspace when somebody should see one brand or one client and nothing else.

The two are kept separate deliberately, so a workspace-scoped invitation never quietly becomes account-wide access.

Seats

Team size comes from your plan. Several lanes carry no practical limit, and usage shows what your account has.

A pending invitation is not yet a member. It becomes one when it is accepted.

Adding somebody

See invite your team for the steps, and client permissions model for the agency version.

When somebody leaves

1. Remove them. Access ends immediately.
2. Check report recipients. Removing a user does not remove their address from a report schedule, and this is the step that ends up emailing a client report to a former employee.
3. Revoke their API keys and webhooks. Anything created for their own integrations.
4. Check notification routing. Alerts are per person, so anything routed only to them now goes nowhere.

Try this in Outercite

Open team settings and check two things: that every member's workspace list matches what they work on, and that no report schedule still names somebody who has left.

Related