Roles and project access
Owner, Admin, Member, and Guest, plus a per-person list of which projects they can see. Enforced in the database, not just the interface.
By ToDidIt Product TeamUpdated
- Owner created the workspace and runs billing.
- Admin runs the team: invites, roles, project access, and can see every project.
- Member is a regular teammate who sees and edits only the projects they have been given.
- Guest is read-only on the projects they have been given.
When you invite someone you choose which projects they land in, and those are the only projects they will ever see. Everything else in the workspace is invisible to them. You can change what they have at any time from the members list.
This is row-level security in Postgres, not a filter in the interface. There is no URL to guess, no API call that returns the rest, and no view that forgets to apply the check. It is the same mechanism whether a request comes from the app, the search box, or an export.
Two dropdowns on their row, and they answer different questions. The role decides what they can do; the access decides which projects they can do it in.
Open the workspace you want to change.
Open WorkspacesSettings, then Workspaces, then the one you mean. Roles are per workspace, so the same person can be an admin in one and a guest in another.
Find them in Members.
Two rows are deliberately locked. The owner cannot be edited here, because handing over a workspace is its own flow, and you cannot change your own row, which is what stops an admin demoting themselves out of the workspace.
Set the role: Admin, Member, or Guest.
Admin runs the team and sees everything. Member edits the projects they have been given. Guest reads them without editing.
Then set what they can see.
"Assigned projects only" keeps them to the projects you pick. "All projects" covers everything in the workspace including projects made later, as a Member who can edit or a Guest who cannot.
Tip
Both changes save on the spot, and both are enforced in the database rather than the interface, so a narrowed access takes effect everywhere at once: the app, search, and exports.
There is a plain-language role legend inside the members area, so nobody has to remember any of this to invite someone correctly.
Similar readings
Everything below is in the Happiness Center.
Inviting teammates
Invite by email and choose exactly which projects they land in. Unlimited teammates on every paid plan, with no per-seat charge.
Public share links
Turn any project or task into a read-only link for someone with no account, with control over what it shows and when it stops working.
How your data is protected
Encrypted in transit and at rest, with row-level security on every table so you can only ever reach your own rows.
What do the roles mean?
Owner, Admin, Member, Guest.