> ## Documentation Index
> Fetch the complete documentation index at: https://docs.joystream.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Invite and manage members

> Add people to an organization and its workspaces, choose their roles, and remove access.

Membership has two levels. Someone joins an organization, then joins the workspaces within it. Adding them to one does not add them to the other.

<Steps>
  <Step title="Invite them to the organization">
    ```bash theme={null}
    jstm org invite acme-corp dana@acme.com
    jstm org invite acme-corp dana
    ```

    Either a username or an email address works. An email invitation reaches an account with that address registered — including as a secondary address, added with `jstm profile emails add`.

    ```bash theme={null}
    jstm org members acme-corp
    ```
  </Step>

  <Step title="Add them to the workspaces they need">
    ```bash theme={null}
    jstm workspace member-add acme-corp/finance --user-id dana --role member
    ```

    <ParamField path="--user-id, -u" required>
      The user to add.
    </ParamField>

    <ParamField path="--role, -r" default="member">
      `owner`, `admin`, `member`, or `viewer`.
    </ParamField>

    Add people to the workspaces whose work they own, not to everything. Workspaces are the boundary for credentials as well as for agents.
  </Step>

  <Step title="Check who has access">
    ```bash theme={null}
    jstm workspace members acme-corp/finance
    jstm workspace members acme-corp/finance --json
    ```
  </Step>
</Steps>

## Roles

| Role     | Can                                                                        |
| -------- | -------------------------------------------------------------------------- |
| `owner`  | Everything, including deleting the workspace                               |
| `admin`  | Manage members, credentials, and settings; audit and scope org credentials |
| `member` | Build, run, and operate agents                                             |
| `viewer` | Read the workspace without changing it                                     |

Org-level administration — auditing credentials across every workspace, or changing a credential's scope — requires owner or admin at the organization, not at a team.

Sharing an agent or run requires owner or admin in a team workspace; in an organization workspace, any role except viewer.

## Changing a role

```bash theme={null}
jstm workspace member-update acme-corp/finance --user-id dana --role admin
```

<Tip>
  Promote to `admin` when someone needs to manage the team's credentials, not merely to use them. `member` is enough to build, run, and operate agents.
</Tip>

## Removing access

```bash theme={null}
# Remove from one workspace
jstm workspace member-remove acme-corp/finance --user-id dana --yes

# Remove from the organization entirely
jstm org remove acme-corp dana
```

When someone leaves, remove them from the organization. Then check what they left behind:

```bash theme={null}
jstm vault audit --org acme-corp
```

The audit shows who connected each credential. A credential connected by a departing colleague will stop working when their access is revoked at the provider, so reconnect those under someone who is staying, or under a service account.

<Warning>
  Agents built in a personal workspace leave with the person. If work matters to the team, it should live in a team workspace. Move it with `jstm agent move`.
</Warning>

## Controlling who can join at all

```bash theme={null}
jstm workspace update acme-corp/finance --access-mode RESTRICTED
```

`OPEN` lets organization members discover and join a workspace. `RESTRICTED` makes it invitation-only.

## Bringing someone in around specific work

If you want to show someone a run or an agent rather than hand them a workspace, share it instead. Accepting a share adds them as a member and takes them straight to the object. See [Share agents and runs](/guides/share-agents-and-runs).

## See also

* [Workspaces and organizations](/concepts/workspaces-and-organizations) — the model.
* [`jstm workspace`](/cli/workspace) and [`jstm org`](/cli/org)