The four roles
| Role | Can | Cannot |
|---|---|---|
| Owner | Everything, including billing + delete workspace | — |
| Admin | Invite / remove members, configure signals, manage workspace settings | Change billing, delete workspace |
| Editor | Create projects, cut clips, edit captions, publish | Manage members, configure signals |
| Viewer | View projects, comment, approve clips | Cut clips, publish |
Seats by plan
- Free — 1 seat (just you).
- Pro — 3 seats. You + 2 teammates.
- Studio — 10 seats.
- Enterprise — unlimited.
Inviting
Settings → Team → Invite member. Enter an email + role. What happens next, step by step:
- SSR route
/api/team/inviteverifies your session + resolves your workspace. - Admin-api Lambda creates a Cognito user if the email isn’t already in the pool.
- Adds them to the
ws_<workspaceId>Cognito group so AppSync auth works. - Writes a
Membershiprow with the role you picked. - Cognito emails them a welcome link with a one-time password.
- A
team.activitynotification fires to you confirming the invite went out.
Changing someone’s role
Same panel. The team list shows every member; click the role dropdown to change it. The same admin-api Lambda validates your own role before applying the change — only owners and admins can change anyone’s role.
Removing a member
Removes them from the Cognito group (losing AppSync access) and deletes the Membershiprow. Their Cognito account is not deleted — they keep it for any other workspace they’re in.