Roles
Admin has full workspace administration access. Admins manage settings, members, groups, and permissions; they retain access to permissions set to Admin only. By default, Admins can manage billing and security, configure governance, control the external Frame-sharing policy, and enable or disable Audit Logs. Manager can invite and remove members, change roles of non-Admins, assign Manager or Member roles, view analytics and usage, act on credit-upgrade requests, and choose which groups can create or publish Agents and Skills. Managers do not have billing or security access by default. They cannot change the external Frame-sharing policy or enable or disable Audit Logs; when external sharing is enabled, they can configure which groups may invite people to Frames and publish them. Member uses workspace resources according to group permissions, resource access, and other grants. Members have no administrative access by default, but Admins can grant additional permissions through groups.Groups and permission modes
Groups can be provisioned from an identity provider through SCIM or created and managed manually. Permissions are granted to groups. To grant a permission to one person, create a manual group for them and grant the permission to that group. Permissions are additive: members of multiple groups receive the combined grants. Each governance permission can be set to Everyone, selected Groups, or Admin only.Permission matrix
Billing and security are permissions rather than separate workspace roles. An Admin can delegate either permission to selected groups without changing their members’ roles. Effective access combines a person’s role, group permissions, and access to the specific resource.