Members & Roles
Everyone in your workspace can sign in and see the workspace's data. There is no per-seat pricing — plans are priced by data volume. Manage people under Settings → Members (/settings/team).
Roles
There are exactly three built-in roles.
| Role | Can do |
|---|---|
| Owner | Everything an admin can do, plus: invite and remove members, change roles, manage billing (currency, checkout, portal, spend cap), and delete the workspace. |
| Admin | Invite and remove members, and manage API tokens and projects. |
| Member | Use projects and data. Cannot manage membership, tokens, projects, or billing. |
Only an owner can change another person's role. Promoting someone to owner cannot be undone from this page — owners can't be demoted here.
Permissions at a glance
| Action | Owner | Admin | Member |
|---|---|---|---|
| Use projects and view data | Yes | Yes | Yes |
| Invite and remove members | Yes | Yes (members only) | No |
| Change roles | Yes | No | No |
| Manage projects and keys | Yes | Yes | No |
| Manage API tokens | Yes | Yes | No |
| View invoices | Yes | Yes | No |
| Change the plan, currency, spend cap | Yes | No | No |
| Configure SSO, MFA, audit retention | Yes | No | No |
| Delete the workspace | Yes | No | No |
Custom roles
Beyond the three built-in roles, you can configure custom roles for members under Settings → Roles (/settings/roles). A member's custom role is shown alongside their built-in role on the members page.
Namespace-scoped members
On Scale and Enterprise, an owner or admin can limit a member to specific Kubernetes namespaces. Members with a namespace limit only see telemetry from those namespaces. Set or clear the limit from the member's row on the members page.
Inviting someone
Owners and admins send an invite:
- Open Settings → Members (
/settings/team) and choose Invite a teammate. - Enter the person's email and pick a role (Member, or Admin if you are an owner).
- The recipient gets an email link. They open
/invite/{token}and are added to the workspace with that role.
The invite token expires after 7 days. Pending invites are listed under the invite form, where an owner or admin can withdraw one so the link stops working.
Removing members
- An owner or admin can remove a member.
- An owner can remove an admin or another member.
- An admin can remove members but not other admins or owners.
- A person can leave a workspace themselves. The last remaining owner must make someone else an owner before leaving.
Removing or leaving takes effect immediately; the person can be invited again later.
Signing in
Invite-based sign-in works on every plan: a member sets up access from the invite link and signs in at console.owlpane.com. On Scale and Enterprise, you can additionally route and enforce sign-in through your own identity provider with SAML 2.0 or OIDC, and keep membership in sync with SCIM 2.0 — see SSO & Provisioning.
If two-step verification is required for the workspace, members who have not set up an authenticator app or passkey are locked out until they do. Owners can turn this requirement on from Settings → Workspace security.
Activity log
The members page shows an Activity feed for owners and admins: who invited, joined, changed a role, created or revoked a project or key, and similar workspace events. This is the same record that underpins the audit log — see Audit & Retention for retention and export.
Related
- Plan & Billing — billing actions are owner-only.
- API Tokens — owners and admins manage tokens.
- SSO & Provisioning — automate membership with SCIM on Scale and Enterprise.
Last updated