A role decides what somebody can do. This decides which websites they can do it to. The two work together, and most people only discover the second one exists when they go looking for it.
When you would use it
- An agency or contractor working on two of your fifteen sites.
- A team inside a larger organisation that should only see its own brand, region or product.
- A client who should see their own site and have no idea the others exist.
- A new colleague you want to give a narrow surface to for their first few weeks.
Setting it up
Open Team, find the person, and assign the specific websites they should reach. This is an Owner task; other roles can see the team list but cannot change these assignments.
What they see afterwards
Only the websites you assigned. Sites they are not assigned to do not appear in their website list, their dashboard, their scan history, their notifications or anywhere else. There is no greyed out row hinting that something exists but cannot be opened, because that would leak the fact that it exists at all.
What it does not change
Their role still applies in full to the sites they can reach. Restricting an Admin to two websites does not stop them being an Admin of those two: they can still remove them, verify them and manage the team. If you want to narrow what they can do as well as what they can see, change their role too.
Sites you add later
A restricted person does not automatically gain access to websites you add afterwards. That is deliberate, and it is the part that catches people out. When you add a site that a restricted colleague is meant to work on, go back to Team and assign it, or they will tell you the site is missing.
When to use separate workspaces instead
Per-website access is the right tool inside one organisation. If you are handling sites for several unrelated clients who should never learn of one another, separate workspaces give you cleaner separation, including separate team lists. See When to use more than one workspace.