# Members and roles

Inviting people, the two team roles, company administration, and exactly what happens when someone is removed.

Status: Available

Documentation updated: 2026-09-23

Source: https://docs.orneos.com/docs/members-and-roles

## The two roles

A team member is either an **admin** or a **member**.

| | Member | Admin |
|---|---|---|
| Read the team's issues and projects (Vault access is per space) | Yes | Yes |
| Create and edit issues, projects, comments | Yes | Yes |
| Create and edit labels, saved views | Yes | Yes |
| Approve an [Intent](https://docs.orneos.com/docs/intent) | Yes | Yes |
| Add an existing company member to the team | No | Yes |
| Remove people from the team | No | Yes |
| Change a member's role | No | Yes |
| Rename the team, edit board columns | No | Yes |

Roles are **per team**. Being an admin of one team grants nothing in another.

Company administration is separate: company admins create teams, invite new people by email and manage company membership. Renaming a team, changing its key or administering its roster requires admin membership of that team; company-admin status alone does not grant it. A company admin can remove someone from the company entirely. That is a stronger action than removing them from a team — see below.

[Vault spaces have their own roles](https://docs.orneos.com/docs/vault-spaces) — viewer, editor, admin — layered on top of team membership.

## Inviting someone

**Adding an existing company member to a team:** a team admin uses the team's roster under **Settings → Teams** to add them and choose their team role.

**Inviting a new person by email:** a company admin uses **Settings → Members** and chooses the initial teams and roles. The whole Members tab is company-admin-only. An email already in the company is rejected by the invitation path; use the team roster instead.

Pending invitations can be revised or revoked. Re-requesting the same pending invitation avoids sending a duplicate. Once claimed, changes to the person's team role use the roster controls rather than editing the old invitation. The invitee must sign in with the invited email address to claim the grant.

## What happens when a grant arrives

You have been added to a new team. What you see depends on where you are:

- **A signed-in session** receives a membership-change signal and refreshes its permitted scope. The current transition can reload the workspace; pending changes can delay that refresh.
- **If the team is still missing**, reconnect and reload to request current membership. A failed membership request is not proof that access was removed.

If a newly granted team does not appear, reload before reporting it. If it still does not appear, [tell us](https://docs.orneos.com/docs/support) — that is a real bug.

## What happens when access is removed

This is the part worth reading carefully, because a local-first product cannot honestly claim what a server-rendered one can.

**Removed from a team.** Server-side authorisation is re-derived from durable membership, so the removed client stops receiving that team's future events and new requests for that team's data fail. The client attempts to purge the team’s rows and replay position when it reconciles. Cleanup can be delayed or fail; revocation is not a guarantee that previously delivered data has been erased.

**Removed from the company.** The stronger case. The client halts its runtime and attempts to wipe the entire local replica and underlying storage, as described in [Companies and teams](https://docs.orneos.com/docs/companies-and-teams).

**What revocation cannot do**

Removal stops *future* access. It cannot reach into a machine that is offline, or into a copy someone took, and erase what was already delivered. A client that is powered off at the moment of revocation holds what it held until it next connects.

We state this rather than implying otherwise, because the honest version of "we revoked their access" for any local-first product is "we stopped delivering to them and cleared what we could reach". If your threat model needs guaranteed erasure on a device you do not control, no product of this shape can give you that.

## Related

- [Security and isolation](https://docs.orneos.com/docs/security) — how tenant isolation is enforced.
- [Personal access tokens](https://docs.orneos.com/docs/personal-tokens) — credentials that carry a person's identity without a browser session.
- [Companies and teams](https://docs.orneos.com/docs/companies-and-teams) — the boundaries these roles sit inside.