Team and roles
Full permission matrix, invitation flow, and the one-owned-org rule.
Team and roles
Admin+This is the full reference for organization roles, what each one can do on every dashboard surface, and the invitation lifecycle. For the short version, see Invite your team.
The four roles
Each role includes everything the role below it can do, then adds more.
- Viewer reads only. Sees documents, invoices, and insights, and cannot change anything.
- Member adds editing of business data: invoices, vendors, tags, manual upload, bank statements, and reconciliation.
- Admin adds management of sources, AI rules, integrations, exports, webhooks, forwarding, portals, org settings, and the team itself (invites and member roles).
- Owner adds billing and organization deletion. There is exactly one owner per organization.
Full permission matrix
| Capability | Viewer | Member | Admin | Owner |
|---|---|---|---|---|
| View documents and invoices | yes | yes | yes | yes |
| View insights | yes | yes | yes | yes |
| Manage own extension tokens | yes | yes | yes | yes |
| Edit invoices and receipts | no | yes | yes | yes |
| Manage vendors | no | yes | yes | yes |
| Manage tags | no | yes | yes | yes |
| Manual upload | no | yes | yes | yes |
| Exclude a document | no | yes | yes | yes |
| Share a document via public link | no | yes | yes | yes |
| Upload bank statements | no | yes | yes | yes |
| Manual reconciliation | no | yes | yes | yes |
| Trigger a retroactive scan | no | yes | yes | yes |
| Reprocess documents | no | no | yes | yes |
| Delete a document | no | no | yes | yes |
| Delete a bank statement | no | no | yes | yes |
| Manage sources (Gmail, Outlook, IMAP) | no | no | yes | yes |
| Pause or resume auto-sync per source | no | no | yes | yes |
| Manage AI rules | no | no | yes | yes |
| Manage Email Routing rules | no | no | yes | yes |
| Manage webhooks | no | no | yes | yes |
| Manage export targets | no | no | yes | yes |
| Manage integrations (Drive, Sheets, OneDrive) | no | no | yes | yes |
| Manage forwarding addresses | no | no | yes | yes |
| Manage portals (Amazon Business, Azure) | no | no | yes | yes |
| Manage bot sources (Telegram, WhatsApp) | no | no | yes | yes |
| Org settings (general, amount format, auto-tag) | no | no | yes | yes |
| Invite members and change their roles | no | no | yes | yes |
| Remove a member | no | no | yes | yes |
| View subscription, balance, and usage history | no | no | yes | yes |
| Buy plans and credits, open the payment portal | no | no | no | yes |
| Delete the organization | no | no | no | yes |
A few guardrails sit on top of the matrix. An admin can change roles up to admin but cannot grant the owner role. An admin cannot remove the owner, and no one can remove themselves (use Leave organization for that). Billing splits in two: admins and owners both read the subscription, balance, and history, while only the owner can buy or open the customer portal.
Invitation flow
Open Members
Go to Dashboard, then Settings, then Members, then click Invite user. Admins and owners can do this.
Enter the email and pick a role
Choose viewer, member, or admin. The owner role cannot be handed out by invite, which the one-owned-org rule below explains.
Send the invitation
Click Send invitation. The invitee gets a magic-link email.
Invitee accepts
They click the link, land on the acceptance page, confirm, and join the organization at the role you picked.
The token is tied to the email address you typed. Opening the link from a different address will not redeem it.
One-owned-org rule
A user can own at most one organization. If you already own one, the create-org step is refused with the ALREADY_OWNS_ORG error and the dashboard shows it.
The limit only applies to the owner role. You can be admin, member, or viewer in as many other organizations as you like.
There is no in-product ownership transfer yet. For now, create the new organization under the intended owner, invite the previous owner as an admin, then delete the old organization.
Removing a member
Go to Members, click the member's row, then click Remove. The member loses access to this organization right away and keeps access to any others they belong to. Removing someone does not delete the documents, vendors, or other data they created here. The owner cannot be removed this way, and you cannot remove yourself.
Related
Ready to try this?
Inbox Ledger turns your inbox into clean accounting data. The free tier includes 10 credits, refilled every 30 days.
Start free