Team & roles

Everyone in a project's organization can open it in Grey. The first time someone opens it, Grey gives them a role matched to their organization role:

• Organization Owner: Owner.
• Organization Manager: Manager.
• Any other organization role: Member.

Nobody becomes an Admin automatically; give someone that role in Grey.

To give someone access, add them to your organization in Dash. Roles in Grey are per project, so the same person can be an Admin in one project and a Viewer in another. Change a role in Settings → Team & Members; it doesn't change their organization role.

Someone you remove from a project doesn't get access back by opening it again.

Every project has five built-in roles:

• Owner: everything, now and in the future. Its permissions can't be edited.
• Admin: every permission, including the team, roles, model providers, API keys, MCP servers, widgets, usage and settings.
• Manager: every screen, plus managing knowledge bases, sources, ingestion, presets, the knowledge graph and its ontology, managing and publishing pipelines, evaluations, data exports and inviting people. Not model providers, delivery, usage settings, roles or project settings.
• Member: every screen except Settings, plus uploading sources, running ingestion, editing the knowledge graph and managing evaluations.
• Viewer: read-only access to Overview, Knowledge Bases, Knowledge Graph and Playground. A Viewer can chat in the Playground.

Admins and Owners can edit the built-in roles' permissions (except Owner's) and create custom roles. A project always keeps at least one Owner: Grey won't change, suspend or remove its last one.

Permissions come in two kinds, grouped on the Roles & Permissions screen.

• Workspace views: one per sidebar section, from Overview to Settings. Without a section's view permission, the section and everything under it disappears from your sidebar and from search.
• Actions: what you can change, such as Manage knowledge bases, Upload sources or Publish pipelines. Without one, the matching buttons and menu items are disabled, with a note on hover saying why, or don't appear.

Each Grey guide names the permission an action needs. Permissions apply to the whole project, not to single knowledge bases or pipelines.

Settings → Team & Members lists who's in the project. You need the Settings view permission, which Owners, Admins and Managers have. The tabs are Members, Invitations, Groups and Activity.

On Members, each row shows the person's name and email, role, groups, status (Active or Suspended), when they were last active and when they joined. Filter by role, status and group, or search by name or email.

Each row's ⋯ menu has Manage, which opens the member's panel, plus Suspend or Reactivate and Remove if you can assign roles. You can also change a role from the role badge in the row.

Choose Manage on a member to open their panel.

• Role: pick another role. It applies straight away, and the panel lists what the new role can do.
• Groups: select the groups they belong to.
• Suspend: pauses their access to the project without removing them. Reactivate restores it.
• Remove: asks you to confirm, then takes them out of the project. They lose access immediately.

These need the Assign roles to members permission, which Owners and Admins have. Grey refuses to change the role of, suspend or remove the project's last Owner: give someone else the Owner role first.

• Invitations: Invite people records a pending invitation for each address in Email addresses (separate them with commas or new lines), with a Role (Member to start with) and an optional Group. Grey doesn't email anyone, and only people in the project's organization can open the project. Pending invitations are listed on the tab, each with Revoke. Inviting needs the Invite team members permission.
• Groups: sub-teams for organizing members. New Group takes a Name and a Description. Groups don't change what anyone can do.
• Activity: who invited, removed, suspended or reactivated whom, who changed someone's role or groups, and who created groups or created, edited and deleted roles. Nobody can edit it.

Settings → Roles & Permissions has two tabs. Roles lists every role as System or Custom, with how many people hold it. Permission matrix shows every permission against every role: click a cell to grant or remove it.

To create a role, choose Create role. Give it a Name and optional Description, and under Start from pick an existing role to copy its permissions, or Blank (no permissions).

Click a role to open its panel, where its permissions are grouped with a switch each, and Select all or Clear for a whole group. Changes save as you make them. A role's ⋯ menu has Edit permissions, Rename, Duplicate, View in Team and, for custom roles, Delete. Deleting asks you to confirm, and anyone holding the role loses the access it gave them. Owner can't be renamed or edited, and built-in roles can't be deleted.

Changing roles needs the Create and edit roles permission, which Owners and Admins have. Everyone else sees the roles read-only.