Client permissions model
Two things control access: a role, which says what somebody can change, and workspace membership, which says whose data they can see.
Access is two decisions, not one. The role decides what a person can change. Workspace membership decides whose data they can see. Most access mistakes come from setting the first and forgetting the second.
What you'll learn
- The roles, and what each can do
- Why workspace membership is the more important half
- How to give a client access to their own workspace safely
The roles
| Role | Can do |
|---|---|
| Owner | Everything, including the plan and billing |
| Admin | Everything operational, including inviting people |
| Member | Work inside the workspaces they belong to |
Only an owner or an admin can invite. This is enforced on the server, so it is not a matter of which buttons are visible.
Workspace membership is the real control
A role without membership sees nothing client-specific. A member of two workspaces sees exactly those two.
When you invite somebody, scope the invitation to the workspaces they work on. An organisation-level role is a different thing from workspace membership, and the platform deliberately keeps them separate so a workspace-scoped invitation never quietly becomes account-wide access.
The common mistake is inviting a contractor as an organisation member because it is one click fewer, then relying on them to only open the right client. Scope the invitation instead.
Giving a client access to their own workspace
Invite them scoped to their workspace, as a member. They get their own data, their own reports, and nothing else. They do not see your portfolio, your other clients, your allowance or your billing.
Two things to decide before you do it:
- Do they want the live product or a report? Access is better for an engaged client and worse for a disengaged one, because an unexplained empty state turns into a support call to you.
- Who fields the questions? A client with access will ask about exclusions and unmeasurable changes. Send them when a number is missing at the same time as the invitation.
When somebody leaves
- Remove them. Access ends immediately.
- Check report recipients: removing a user does not remove their address from a schedule.
- Revoke API keys and webhooks that were personal to them.
Step 2 is the one that ends up emailing a client report to a former employee.
Try this in Outercite
Open team settings and check every member's workspace list against the clients they actually work on.
Related
Parent orgs vs workspaces
What sits at each level.
Invite your team
The mechanics of an invitation.
Handle a client handover
Moving a client between account managers cleanly.
Last updated on