Every person in a workspace has a role. There are five to start with, and you can build your own if none of them fit.
The five
Owner
Full control, including billing, and the only role that can export the whole workspace. There is one owner. If the owner is leaving the company, hand the role over before they go rather than after.
Admin
Almost everything the owner can do, including managing websites and people. The right role for whoever actually runs the account day to day.
Member
The working role. Can see websites, view results and run scans, without managing people or billing. This is the right default for most of your team.
Billing-only
Sees billing and invoices and nothing else. For finance colleagues who need the paperwork and have no reason to see scan results.
Read-only
Can look, cannot change anything. For stakeholders, auditors and anyone who wants visibility without the ability to start work.
Choosing quickly
| If they need to | Give them |
|---|---|
| Run everything, including billing | Owner |
| Manage sites and people | Admin |
| Work on findings and run scans | Member |
| Handle invoices only | Billing-only |
| Watch without touching | Read-only |
When none of them fit
You can build a custom role from individual permissions, grouped by area: Websites, Scans, Team, Billing, Workspace, Support, Service Requests and API. See Building a custom role.
Roles are not the only control
A role says what someone can do. You can separately decide which websites they can do it to. See Limiting someone to specific websites.