> ## Documentation Index > Fetch the complete documentation index at: https://docs.upsolve.ai/llms.txt > Use this file to discover all available pages before exploring further. # Roles & Permissions > Who can build, who can only ask, and how your own team differs from the customers you sign in. Two kinds of people use Upsolve, and their access is set in different places: * **Your team** are members of your Upsolve organization. You invite them, and each has an **organization role**: owner, admin, member, viewer or end user. The role decides whether they can build. * **Your customers** are **project organizations** and **project users**. Your backend signs them in, or you add them by hand, and they carry the properties your [data security rules](https://docs.upsolve.ai/ai-agent-builder/data-governance.md) read. They never build anything. Data security applies to everyone in both groups. A role decides what someone can do in Upsolve, never which rows they see. ## Organization roles | Role | Shown as | Who it's for | | - | - | - | | **Owner** | Owner | Full access, including the team and billing. An owner can't be removed from the organization. | | **Admin** | Admin | Full access to every project, setting and team member. | | **Member** | Member | Builders: can build and change projects and workspaces, but can't manage the team or billing. | | **Viewer** | Viewer | Can open workspaces and ask them questions, but can't change anything. Called `readonly` in the API. | | **End user** | End User | Asks the workspaces they're given access to, with no builder tools. Called `end-user` in the API. | Owners, admins and members are the **builders**. Throughout these docs, "builders" means those three roles. ### What each role can do | | Owner, admin | Member | Viewer | End user | | - | :-: | :-: | :-: | :-: | | Ask a workspace's agent, save favorites, build their own canvases | ✓ | ✓ | ✓ | ✓ | | Open the Playground, and Home in User mode | ✓ | ✓ | ✓ | | | Change a workspace: data model, data security, context, tests | ✓ | ✓ | | | | Use the [Builder agent](https://docs.upsolve.ai/ai-agent-builder/builder-agent.md) and [guided setup](https://docs.upsolve.ai/ai-agent-builder/setup-guide.md#step-4-set-up-the-workspace) | ✓ | ✓ | | | | Save a version, and [deploy](https://docs.upsolve.ai/ai-agent-builder/environments.md#save-then-deploy) it with the tests its environment requires | ✓ | ✓ | | | | Open [Chat History](https://docs.upsolve.ai/ai-agent-builder/chat-history.md), [Analytics](https://docs.upsolve.ai/ai-agent-builder/analytics.md), [Rules & Actions](https://docs.upsolve.ai/ai-agent-builder/rules-monitoring.md) and [API Activity](https://docs.upsolve.ai/ai-agent-builder/api-activity.md) | ✓ | ✓ | | | | Sign customers in with [`embed-token`](https://docs.upsolve.ai/embedding) using their API key | ✓ | ✓ | | | | Deploy or promote a version without the tests its environment requires | ✓ | | | | | Invite and remove team members, manage billing | ✓ | | | | Saving a version runs no checks: tests run when a version is deployed to an environment that requires them. A member's work therefore reaches those users through tests, and only an owner or admin can skip them. A viewer sees only **Home** and the **Playground** in a workspace's sidebar. They can still save their own favorites and canvases, because those belong to them and change nothing anyone else sees. ### End users An end user is someone on your team, or a customer you'd rather invite than embed for, who should ask questions and nothing else. When you invite one, you pick the projects, and the workspaces in each, they can open. They see a simple workspace page with the chat and the canvases shared with them. Each end user acts as their own project user in each project they can open, so data security rules apply to them by their own properties, exactly as they do to an embedded customer. ## Invite your team 1. Open the account menu at the bottom left and choose **Organization settings**, then the **Members** tab. 2. Click **Invite user** and pick a role: **Admin**, **Member**, **Viewer** or **End User**. 3. For an **End User**, also pick the projects they can open. In each project, give them **All workspaces, including new ones**, or pick workspaces one by one, and choose which one they land on (**Opens in**). 4. Enter their email address and click **Invite**. ![The Invite user dialog with the End User role selected, Procurement Demo Project ticked with All workspaces, including new ones, and Opens in set to First available](https://mintcdn.com/upsolve/b1jyK_S-fI8SzClk/images/ai-agent-builder/roles/invite-end-user.png?fit=max\&auto=format\&n=b1jyK_S-fI8SzClk\&q=85\&s=8ac3318327d4925dc4a2374d1ddd3082) The invitation email signs them in. Someone who already has an Upsolve account gets the new organization added to theirs. ## Your customers: project organizations and project users Customers don't get an organization role. They live inside a project: * A **project organization** is one of your customers (a tenant), with properties such as `company_id`. * A **project user** is a person at that customer, with properties such as `department` and `email`. Your backend creates and updates both on every sign-in with one call, [`POST /v1/api/projects/embed-token`](https://docs.upsolve.ai/api-reference/endpoint/create-embed-token). You can also add them by hand in the project's **Organizations** and **Users** tabs to try your rules before your integration exists. See [Projects & Connections](https://docs.upsolve.ai/ai-agent-builder/projects.md) and [Embed Upsolve in your product](https://docs.upsolve.ai/embedding.md). In a project with [environments](https://docs.upsolve.ai/ai-agent-builder/environments.md), each project organization and its users belong to one environment. ## Other roles you'll see Two other kinds of role are separate from the organization role: * **Canvas roles.** Each person a canvas is shared with is its owner, editor or viewer. See [Canvas](https://docs.upsolve.ai/ai-agent-builder/interact/canvas.md#roles). * **Project user roles** (Admin, Editor, Creator, Reader) only control what an embedded user may do on a legacy Applications dashboard. See [Roles and permissions for Applications](https://docs.upsolve.ai/embedding-permissions.md). ## Roles in other places The same roles apply wherever someone reaches Upsolve: * **From Claude or another MCP client**, everyone can ask, save favorites and build canvases, and only builders can build, test, save versions and promote them. See [Upsolve MCP Server](https://docs.upsolve.ai/ai-agent-builder/deploy-agents/mcp-server.md#roles). * **In Slack**, everyone asks as themselves, under their own data access. See [Use Upsolve in Slack](https://docs.upsolve.ai/slack/overview.md). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.