# Understanding roles and permissions

Every member has a role in each workspace. Roles control workspace administration. The tools an AI client can use are a separate, live permission decision.

Groups and API keys are included in the Growth and Enterprise plans. See [pricing](/pricing).

## Roles at a glance

| Permission | User | Admin | Owner |
|---|---:|---:|---:|
| View workspace activity | Yes | Yes | Yes |
| Use tools currently allowed for the member | Yes | Yes | Yes |
| Manage workspace settings and invitations | No | Yes | Yes |
| Manage connections and member access | No | Yes | Yes |
| Manage groups and API keys | No | Yes | Yes |
| Change or remove the owner | No | No | — |
| Transfer ownership or delete the workspace | No | No | Yes |

## User

Users can work with the tools currently allowed for them and review workspace activity. They cannot change workspace settings, membership, connections, or another person's access.

## Admin

Admins manage the workspace day to day. They can update settings, invite or remove users, manage connections, and change member access. An admin's own AI client access is still evaluated separately; the admin role does not automatically expose every tool.

## Owner

Each workspace has one owner. The owner can do everything an admin can, and can also transfer ownership or delete the workspace. Ownership is transferred to an existing member. The previous owner becomes an admin.

## Live AI client permissions

OAuth binds a user-authorized client to the workspace selected during consent. For each `tools/list` and `tools/call` request, Connector Central checks the token, workspace membership, direct or group connector grants, connected-account reach, and connection availability. Removing access affects the next request.

An API key is a workspace-bound unattended credential rather than a member. It does not inherit the creator's role, groups, or connector grants. An admin or owner must grant the key its own access to each connector and may restrict which connected accounts it can reach.

## Changing a role

Open **Team** under **Admin**. An admin or the owner can change a member between user and admin or remove them. Only the owner can transfer ownership.

## Next steps

- [Invite team members](/docs/team-and-collaboration/inviting-team-members)
- [Use groups](/docs/team-and-collaboration/using-groups)
- [Manage connectors and access](/docs/connectors-and-access/connectors-accounts-and-access-grants)
- [Create and secure API keys](/docs/api/api-keys)
- [Review workspace settings](/docs/workspace-settings/general-settings)
- [Connect an AI client](/docs/connect-ai-clients/chatgpt)