Members and Roles

Invite teammates from Admin > Members. Each member gets a role, and some members can be restricted to specific workspaces.

Roles

• Admin: manage organization settings, workspaces, members, and content.
• Editor: write and publish content in allowed workspaces.
• Viewer: read private content in allowed workspaces.
• Guest: read only the workspaces and pages assigned to them.
• Billing: manage billing without broad content administration.

Workspace scope

Use restricted access when a member should only see part of the organization. A restricted member can only reach assigned workspaces. Cross-workspace access behaves like the workspace does not exist.

Guests

Guests are useful for customers, contractors, and reviewers. Assign only the workspaces and articles they need.

Invites

Invites are per organization, and they carry the role and the workspace scope you picked. When someone accepts, ContextOwl applies those permissions immediately. There is no separate per-workspace invite: you invite someone to the organization and, for editors, viewers, and guests, choose which workspaces they can reach.

If the person you invited does not have a ContextOwl account yet, they just sign up with the address you invited. Confirming that address puts them straight into your organization with the role you chose, and they do not get an organization of their own. Members who belong to more than one organization switch between them with the ORG picker in the admin header.

If the person already has an account, they do not need the email at all: a pending invitation shows up as a banner at the top of their admin, naming the organization and the role, with one button to join.

An invite link is good for 7 days. If it runs out, hit RESEND on the pending row in Admin > Members: the invitee gets a new email with a new link, the clock restarts, and the role and scope stay as you set them. The old link stops working the moment you resend.

Remove a member

Select Remove on the member row in Admin > Members. The person loses access to the organization at once. ContextOwl also revokes their agent keys and the agents that they connected with their sign-in. A new invite does not bring the keys or the agents back. The audit log records the removal with the number of keys and agents that it revoked.

To stop one agent and keep the member, revoke the key or disconnect the agent in Admin > Settings > API > Member keys.