---
title: Members, roles and invitations
description: Who can do what in a workspace, and how to invite people.
sidebar:
  label: Members & roles
---

{/* Source of truth: packages/shared/src/permissions.ts — WorkspaceRoles,
    Permissions, ROLE_PERMISSIONS, AssignableRoles. Invitation statuses:
    PENDING / ACCEPTED / DECLINED / EXPIRED. */}

## Roles

There are three, and they are fixed — Glowo does not have custom roles.

| Role | Intended for |
| --- | --- |
| `OWNER` | Whoever is accountable for the account and its billing |
| `ADMIN` | People who run the monitoring |
| `MEMBER` | People who need to see it but not change it |

`OWNER` is implicit and cannot be assigned from the member list; you can invite
people as `ADMIN` or `MEMBER`.

## What each role can do

| Permission | Owner | Admin | Member |
| --- | :---: | :---: | :---: |
| `VIEW_MONITORS` | <span class="tick">✓</span> | <span class="tick">✓</span> | <span class="tick">✓</span> |
| `VIEW_STATUS_PAGES` | <span class="tick">✓</span> | <span class="tick">✓</span> | <span class="tick">✓</span> |
| `MANAGE_MONITORS` | <span class="tick">✓</span> | <span class="tick">✓</span> | <span class="no">—</span> |
| `MANAGE_STATUS_PAGES` | <span class="tick">✓</span> | <span class="tick">✓</span> | <span class="no">—</span> |
| `MANAGE_NOTIFICATIONS` | <span class="tick">✓</span> | <span class="tick">✓</span> | <span class="no">—</span> |
| `MANAGE_MEMBERS` | <span class="tick">✓</span> | <span class="tick">✓</span> | <span class="no">—</span> |
| `VIEW_AUDIT_LOG` | <span class="tick">✓</span> | <span class="tick">✓</span> | <span class="no">—</span> |
| `MANAGE_WORKSPACE` | <span class="tick">✓</span> | <span class="no">—</span> | <span class="no">—</span> |
| `MANAGE_BILLING` | <span class="tick">✓</span> | <span class="no">—</span> | <span class="no">—</span> |

The two the owner keeps to itself are workspace settings and billing. Everything
operational is available to admins.

## Choosing a role

Give **`MEMBER`** to anyone who needs visibility — support, sales engineers,
management. They can read every monitor and status page and change nothing.

Give **`ADMIN`** to the people who actually operate the system. Note that admins
can manage members, so an admin can invite other admins.

## Invitations

Invite by email address and role. An invitation is `PENDING` until the recipient
accepts, and can also end up `ACCEPTED`, `DECLINED` or `EXPIRED`. You can cancel
or resend a pending one.

:::caution
An invitation link is a bearer token: whoever holds it can join the workspace
with the role it carries. Send it to the person you meant to invite, and cancel
any invitation that goes astray rather than assuming it will expire safely.
:::

## Removing people

Removing a member revokes their access immediately. Members can also leave a
workspace themselves.

Removing someone does **not** revoke [API keys](/account/api-keys) that were
created in the workspace — those belong to the workspace, not to a person. When
someone with key access leaves, review and rotate them.