Roles and permissions

Understand the Owner, Administrator and Collaborator roles and grant specific permissions to each person.

Team Connect combines two levels of control: each person's role in the company and specific permissions you can turn on or off per member. This guide explains how they work together.

The three roles

Role	Who	Permissions
Owner	The person who created the company in Team Connect	All of them, always. Cannot be removed or demoted.
Administrator	People who help run the office	All of them by default. You can narrow this down by ticking only the ones you want.
Collaborator	Everyone else on the team	No administrative permissions, except the ones you grant.

The role is chosen when you invite someone and can be changed later. See People and invitations.

The permissions

Each permission unlocks one area of administration.

Permission	What it unlocks
Manage team	Invite, remove and change people's roles; edit permissions; pick the library map; manage Room access; set up SSO and SCIM.
Block users	See and edit the Blocks list; use the Block button on a member's row.
Compose office	Open the composer to build or edit the office. See Office and map.
Manage AI agents	Create and configure agents and the company integrations (LLM providers, Git servers, MCP servers and others).
Manage license	On self-hosted installs: view and update the license and sync the catalog. See License.
Manage webhooks	Create, rotate and revoke webhooks for chat channels. See Company integrations.

Change someone's role

Open Configure users in the sidebar.
Under Collaborators, find the person.
In the role selector, choose Collaborator or Administrator.

The change takes effect right away. The Owner role is not in the selector and cannot be granted or taken away here.

Adjust a member's permissions

Under Collaborators, find the person.
Under Permissions, tick or untick each box.

Every change is saved immediately and recorded in the audit log.

How an Administrator's permissions work

A newly invited Administrator has every permission. As soon as you adjust their boxes, only the ticked permissions apply. Use this to create administrators with a narrower scope, for example someone who only composes the office.

Giving powers to a Collaborator

You can grant specific permissions to a Collaborator without making them an administrator. For example, tick Compose office for whoever looks after the layout, or Manage webhooks for whoever connects team tools to the chat.

Safeguards

You cannot remove the Manage team permission from yourself. That way the company is never left without someone to manage people.
The Owner's permissions are not editable.

Audit is for Owners and Administrators only

Admin audit shows the sensitive history of administrative actions. That is why it follows the role, not the permissions:

Owners and Administrators can see the audit log.
A Collaborator cannot see it, even with every permission ticked.

This rule is enforced both on screen and on the server. See Audit.

Good practices

Give each person only what they need day to day (least privilege).
Keep at least two administrators with Manage team, so you never depend on a single person.
Review permissions when someone changes jobs or leaves the company.
Under data protection laws such as Brazil's LGPD, whoever has Manage team or Block users can see the team's personal data. Grant them only to people who actually manage people.