Team and access

Editors cannot delete domains. Analysts differ from viewers in one thing: they can export. Every role can read the guide.

Users → Roles & permissions shows the same thing in full, action by action, read live from the API — so that table and the rules the server enforces cannot say different things.

By default a member sees the whole workspace. An agency usually does not want that: the person who looks after one client should not be reading another client’s consent log, or seeing their name in a list.

Scope is set per client, and a client is a domain group — group your domains on Domains first, then scope people to the groups. It is not set per domain, because that is not the unit anybody manages and it is not the unit the database enforces.

Where to set it

On the invitation (Users → Invite → Client access), or afterwards from the member's row: Edit access → Client access. Choosing "The whole workspace" there removes the limit. Every existing member starts with the whole workspace.

May publish

A separate grant. Someone can be scoped to a client, open their banner, and still not be able to save or publish it — which is the arrangement most agencies want for a junior.

Ungrouped domains

Invisible to a scoped member. A member is scoped to clients, and a domain in no client is in none of theirs — so a scoped member also cannot create a domain without naming its group.

An owner

Never scoped. Somebody has to be able to see everything.

No clients

What a member shows once every client they were limited to has been deleted. They are still limited — to nothing — not given the whole workspace, so they see no domains until an owner chooses new clients for them in Edit access.

What a limited member sees. Their clients’ domains, banners, scans, compliance and consent logs, and nothing of anyone else’s. The Dashboard, Portfolio and Compliance screens show a Showing: line naming their clients, because every total there covers those clients alone. The workspace’s own screens — Workspace, Users, Integrations, the compliance rule-set overview and the plan — are not in their menu, and typing one’s address shows the page-not-found screen. Those belong to the agency, and every client’s data passes through them. Ask an owner if you need one of them changed.

1. Users → Invite, enter an email and a role.
2. They receive an invitation link. Until they accept, the row shows Invited; you can resend or revoke it.
3. Change a role or a member’s client access from the row’s Edit access, or remove them from the same menu. The last owner can be neither removed nor demoted; promote someone else first.