Set up team roles and workspace access

What you will accomplish

Invite an internal teammate with a suitable role, limit workspace and facility access, understand seat effects, and keep client or manufacturing access separate from internal membership.

Before you start

• Open People & Access at /team and confirm the active organization.
• Team membership requires Business or higher. Available seats and workspace limits come from the active plan; check /settings/billing and Pricing instead of relying on copied limits or prices.
• Owner, Lab Admin, and Lab Director can manage team access when their effective permissions allow it. Only the Owner can manage billing.
• Use least access: choose the narrowest role, workspace scope, and facility scope needed for the person's work.

1. Choose the correct access population

Use internal organization membership for employees and trusted operators. Keep client users inside client-account and portal access. Keep manufacturing partner users inside their partner relationship. These populations appear together in /team for governance, but they are not interchangeable seats or roles.

2. Choose an internal role

Select the role that matches the actual duty:

• Owner controls the organization and billing.
• Lab Admin and Lab Director manage broad lab operations and team access.
• QA / Release can review technical evidence and approve release.
• R&D Formulator can edit formulas and read technical records.
• Production Lead and Production Operator execute batch work within their access.
• Procurement / Inventory manages purchasing and inventory work.
• Client / Program Manager coordinates relationship work.
• Internal Reviewer and Auditor / Viewer are read-focused roles.

Custom roles may be available on Lab and above. A manager can invite only roles below their own hierarchy; Owner is not an invite option.

3. Send a scoped invitation

Open /team/members/invite, enter the email address, and choose the role. Then choose one workspace scope:

• All workspaces for organization-wide workspace access.
• Selected workspaces for only the checked records.
• No workspace access when the person should join without workspace visibility.

Choose the same all, selected, or none pattern for facilities and optionally set a default facility. Add a message, send the secure invite, and use the backup invite link only when needed. The member remains pending until they accept.

4. Review members, invitations, and seats

Use /team/members to review active members and pending invitations. A new active internal member consumes an organization seat. The billing owner can review seat capacity and supported adjustments at /settings/billing; current plan and seat terms belong to Pricing and the billing confirmation.

5. Create and assign workspaces

Use /team/workspaces to create separate operational areas for clients, programs, or product lines. Workspace scope controls which workspace records a member can reach; it does not replace the permissions granted by the member's role.

6. Audit and refine access

Review /team/audit and security controls available to the plan. Remove stale invitations, narrow unnecessary workspace or facility scope, and change roles when duties change. Treat client separation as an access boundary, not just a naming convention.

Check your work

• The invite belongs to the intended organization and email address.
• The selected role matches the person's duties and authority.
• Workspace and facility scope show all, selected, or none exactly as intended.
• The member count remains within the seat state shown in billing.
• Client and manufacturing users were not added as internal teammates by mistake.
• A test account can reach required records but not unrelated client work.

If something does not look right

• If Invite is unavailable, confirm Business-or-higher access and member-management permission.
• If a role is missing, it may be at or above your hierarchy; ask the Owner or a higher authorized manager.
• If the invite exists but email delivery failed, copy the secure backup link from the result and share it through an approved channel.
• If a user sees too much or too little, review both role permissions and workspace/facility scope.
• If the seat limit blocks acceptance, ask the Owner to review seats in /settings/billing.

Next steps

• Manage subscription and billing
• Review /team/audit after the member accepts.
• Create or refine client workspaces at /team/workspaces.