Setting role-based access controls

Role-based access keeps sensitive controls — like DNS, billing, and member management — in the hands of the people who should have them, while everyone else gets what their job needs and no more.

The built-in roles

• Owner — full control, including billing and deleting the workspace.
• Admin — manages members, domains, DNS, and email, but not billing ownership.
• Member — uses email, workspace, and shared resources.
• Billing — manages invoices and payment methods only.

Assigning roles

Set a role when you invite someone, and change it any time under Workspace → Members. Follow least privilege: grant Admin sparingly, and prefer the Billing role over Owner for a bookkeeper who only touches invoices.