# Set roles and permissions

> Assign dashboard access and agent chats without confusing them with app roles or paid seats.

Roles group members by dashboard permissions and agent access. Members can hold several roles: agent grants combine; the highest dashboard level applies.

## Before you begin

Owners and dashboard editors manage roles. Only the owner can grant Editor access or manage an Editor role's identity, access level and membership.

## Configure a role

1. Open **Team** and select **Roles**.
2. Create or open a role.
3. Set its name and dashboard access level.
4. Use **Add members** to select its members.
5. Use **Add agents** to grant agent chats.
6. Select **Save changes**.

Editors can manage non-Editor roles and adjust agent grants on any role, including Editor roles. They cannot change the roles of a member who already holds Editor access.

## Choose dashboard access

| Level | Dashboard | Agent chats |
| --- | --- | --- |
| No access | Cannot open the dashboard. | Only agents granted through roles. |
| Viewer | Read operational resources, Workspace, tools and Usage; use the read-only Assistant. Members, Roles and Billing stay hidden. | Every active account agent. |
| Editor | Viewer access plus operational edits, the member directory, member activity and delegated role management. | Every active account agent. |
| Owner | Full governance, including billing, invites, removals, spend limits, credential reveal and app connection choices. | Every active account agent. |

Each dashboard level adds permissions; ownership adds governance beyond Editor access.

A paid seat makes someone an active member. Their business roles determine dashboard access and agent grants; each app separately assigns app roles.

## Check agent and app access

Owners and dashboard members reach every active agent through web, mobile and MCP, without role grants. Editing follows their dashboard level.

Removing agent access hides chats and blocks history and attachments. History returns if access is restored.

Set app roles in each app's **Access** tab. Naming a business role “Editor” does not grant an app role automatically.

## Related

- [Invite and manage members](/en/docs/team/members)
- [App access](/en/docs/apps/access)
- [Permissions reference](/en/docs/reference/permissions)