> ## Documentation Index
> Fetch the complete documentation index at: https://docs.passlet.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Team & roles

> Invite members, assign owner/member/viewer roles, and understand what each role can do.

Workspaces are collaborative. The **Team** page manages members, pending invitations, and roles.

## Roles

Every member has one of three roles:

* **Owner** — full control, including workspace settings, billing, member management, and
  webhooks.
* **Member** — day-to-day work: templates, passes, projects, scanning, access tokens.
* **Viewer** — read-only: can see passes and scan activity, but no create/manage actions.

| Capability                                           | Owner | Member | Viewer |
| ---------------------------------------------------- | :---: | :----: | :----: |
| Templates, passes, projects (create/edit/issue/void) |   ✅   |    ✅   |    ❌   |
| View scans & scan stats                              |   ✅   |    ✅   |    ✅   |
| Scanner app setup & devices                          |   ✅   |    ✅   |    ❌   |
| Access tokens (create/rotate/revoke)                 |   ✅   |    ✅   |    ❌   |
| Webhooks — inspect deliveries                        |   ✅   |    ✅   |    ❌   |
| Webhooks — create/edit/delete endpoints              |   ✅   |    ❌   |    ❌   |
| Team — invite, change roles, remove                  |   ✅   |    ❌   |    ❌   |
| Workspace settings, billing, security policy         |   ✅   |    ❌   |    ❌   |

Pages a role can't use are hidden from the sidebar or show an owners-only notice.

## Inviting people

Owners click **Invite member**, enter an email and a role, and Passlet sends the invitation. Pending invitations can be **resent** or **canceled** from the Team page; invitees accept via the emailed link. Members can also be invited into other workspaces — everyone can switch workspaces under **Settings → Workspaces**.

## Changing and removing members

Owners can change any member's role or **remove** a member — removal takes effect immediately and the person loses workspace access.

## Enterprise SSO

Workspaces with Enterprise SSO configured get a dedicated sign-in path (**Continue with Enterprise SSO** on the login page, or `/login/sso/your-workspace-slug`), and new users whose email domain is verified for SSO see a suggestion to join via SSO during onboarding. Contact your Passlet representative to set up SSO for your workspace.

## Two-factor policy

Owners can **require two-factor authentication** for the whole workspace under **Settings → Policy** — members must then enroll an authenticator app before performing sensitive actions. See [Account & security](/guides/account-security).