Team & access
Invite people, assign roles, and control who can do what — at both the account and project level.
Machine has two levels of access: the account (the whole workspace) and each project. You manage members at both, with roles that decide what each person can do.
Account members
From your account, open Members to manage who belongs to the workspace. Invite people by email; they get an invitation to accept. Each member has an account role:
| Role | Can do |
|---|---|
| Owner | Everything, including billing and deleting the account. |
| Admin | Manage members, projects, and most settings; not billing-destructive actions. |
| Member | Belong to the account and access the projects they're granted. |
You can resend or cancel pending invites, change a member's role, and remove members.
Project members
Each project has its own member list, under Customize → Members. Invite someone to a single project and give them a project role:
| Role | Can do |
|---|---|
| Manager | Full control of the project, including members and settings. |
| Editor | Run sessions and merge changes; can't manage project access. |
| Viewer | Read-only — see sessions, changes, and files without modifying. |
Project access is separate from account membership, so you can give someone access to one project without opening up the whole workspace.
Groups
Instead of adding people one at a time, you can grant a whole group access to a project with a role. Manage groups at the account level, then attach a group to a project — everyone in the group inherits that project role. This is the way to scale access for larger teams: add someone to the group once and their project access follows.
Roles combine sensibly: an account Admin already has broad reach, while a Member only sees the projects they're explicitly granted (directly or through a group). Grant the least access that lets someone do their job.
Related: Accounts concept · Customizing your project.