Roles and Permissions
Understand team membership, Owner and Member roles, seeded workspace permissions, invitations, and primary-owner-only actions.
Last reviewed July 13, 2026
Vendo is team-first: product data belongs to a team workspace, and access is checked against that workspace membership. Open Workspace Settings → Members to review members, pending invitations, and roles.
Roles
| Role | Intended use |
|---|---|
| Owner | Workspace administration, billing, role changes, API-key administration, and approval-sensitive operations |
| Member | Day-to-day workspace use and the non-administrative permissions granted to the seeded Member role |
The primary owner is a specific Owner recorded on the account. Some account-level actions, such as ownership transfer or deleting the workspace, require the primary owner and may require a one-time password.
Seeded permissions
Vendo checks named permissions for administrative and approval-sensitive operations. The current seeded role model includes:
| Permission area | Owner | Member |
|---|---|---|
| Manage roles | Yes | No |
| Manage billing | Yes | No |
| Manage workspace settings | Yes | Yes |
| Manage members | Yes | No |
| Manage invitations | Yes | Yes |
| Read/write/administer API keys | Yes | No |
| Edit commerce operations | Yes | Yes |
| Approve commerce operations | Yes | No |
Feature routes and data tables also enforce team membership, row-level security, feature availability, and resource-specific checks. The table above is not a promise that every route maps only to one named permission.
Invite a member
- Open Workspace Settings → Members.
- Select Invite Member if your role exposes the action.
- Enter the email address and role.
- Send the invitation.
- Track or revoke it under Pending Invitations.
Change or remove a member
Members with roles.manage can change roles when the target role is below their own hierarchy. Member removal is also constrained by role hierarchy and primary-owner rules.
Before removing access:
- Confirm the correct workspace and person.
- Reassign any operational ownership that depends on the user.
- Rotate credentials or provider access the person controlled.
- Remove or update their membership.
- Review API keys and audit activity after the change.
API keys and external tools
API keys are account-scoped credentials with their own scopes and limits. Do not assume an API key safely inherits every property of the creator’s interactive session. Create the narrowest key required, store it as a secret, and revoke it when the integration is retired.
MCP OAuth uses the selected team account and approved mcp:read or mcp:write scope. Tool availability is still constrained by the connected account and server-side authorization.
Troubleshooting
| Symptom | Check |
|---|---|
| Invite button is missing | invites.manage, workspace member limit, and active workspace |
| Role cannot be changed | roles.manage, role hierarchy, and primary-owner status |
| Member cannot open data | Membership, active team workspace, RLS, and feature availability |
| API key action is unavailable | API-key permission and whether an Owner must perform it |