Workspace
Roles and permissions
What each workspace role may do, permission by permission — generated from the role registry.
Every member of a workspace has one role. An admin sets it on /collab/members, with oxygen members role <email> --role <role> or oxygen_members_role_set, or in Settings → Members, where Clerk holds it. Assigning roles, invitations and the agency sign-off motion: Workspace roles.
Roles
| Role | --role | Clerk role | What it is for |
|---|---|---|---|
| Admin | admin | org:admin | Everything, including members and roles, billing, budgets and approval gates. |
| Member | member | org:member | Builds, sets up and runs the workspace, without member, billing, budget or approval-gate settings. |
| Sales rep | rep | org:rep | Works their pipeline: finds and enriches leads, works the CRM and Unibox, adds leads to sequences, uses Copilot and Oxygents and builds dashboards. Doesn't build or set up anything else. |
| Viewer | viewer | org:viewer | Sees everything, comments, decides the approvals assigned to them and builds dashboards. Spends no credits. |
| Client | client | org:client | An agency's client: sees everything, comments and decides the approvals assigned to them. Nothing else. |
What each role may do
A restricted role's refused request answers insufficient_role and names one of these permissions. An admin-only action refuses a member with that action's own …_admin_required code. API keys and connected apps act with their person's role.
| Permission | What it covers | Admin | Member | Sales rep | Viewer | Client |
|---|---|---|---|---|---|---|
| Your own account | Sign in, switch workspaces, manage your own sessions and API keys (each key keeps your role), use skills, and reach feedback and support. | ✓ | ✓ | ✓ | ✓ | ✓ |
| See the workspace | Open every table, record, sequence, conversation, dashboard and run, and run read-only queries. | ✓ | ✓ | ✓ | ✓ | ✓ |
| Comment and decide approvals | Comment on work and decide the approvals assigned to you. | ✓ | ✓ | ✓ | ✓ | ✓ |
| Build dashboards | Create, change and share dashboards. A widget that spends credits also needs “Spend credits”. | ✓ | ✓ | ✓ | ✓ | — |
| Spend credits | Run paid actions within the workspace budget and your own credit limit. | ✓ | ✓ | ✓ | — | — |
| Work with Copilot and Oxygents | Chat with the Copilot and Oxygents, on your own and in group chats. | ✓ | ✓ | ✓ | — | — |
| Find people and companies | Run people and company searches, and find emails and phone numbers. | ✓ | ✓ | ✓ | — | — |
| Edit rows and run enrichments | Add and edit rows and run columns in existing tables. Creating tables or changing columns is “Build and set up”. | ✓ | ✓ | ✓ | — | — |
| Work in the CRM | Log activities, add notes, tasks, files and tags to records, and link records. | ✓ | ✓ | ✓ | — | — |
| Reply in the Unibox | Reply to and triage conversations, and review drafted replies. | ✓ | ✓ | ✓ | — | — |
| Add leads to sequences | Add leads to sequences that are already built, and take them out again. | ✓ | ✓ | ✓ | — | — |
| Connect your own sender | Connect your own mailbox or LinkedIn account. Each connected account takes a paid seat. | ✓ | ✓ | ✓ | — | — |
| Build and set up | Everything not listed separately: create tables and sequences, launch campaigns, build workflows and Oxygents, edit Knowledge, connect integrations and sending setup, buy credit top-ups. | ✓ | ✓ | — | — | — |
| Manage billing | Change or confirm the plan, cancel or resume it, sending seats and the Billing Portal. | ✓ | — | — | — | — |
| Manage members and roles | Invite members and change their roles. | ✓ | — | — | — | — |
| Set budgets and limits | Workspace budgets, each person's credit limit, credit caps and provider rate limits. | ✓ | — | — | — | — |
| Set approval gates | Require an approval before a launch or a sign-off. | ✓ | — | — | — | — |
| Workspace administration | Beta features, egress IPs, Google Workspace, the placement-test network, UGC programs and ending the workspace's infrastructure. | ✓ | — | — | — | — |