Roles and access levels
How the role of a person in a team and their access to each organization decide what they can open and change.
Where to find it:accounts.conta.financeTeamUsers
Two ideas decide what a person can do, and each one has its own words.
- The roleWhat a person does in a team: Owner, Admin or Member. says what the person does in the teamA group of people who work on a set of organizations together, such as a finance team or an accounting firm.: Owner, Admin or Member.
- The access levelWhat a person can do in one organization: Full access, Read and edit, Read only or No access. says what the person does in one organizationOne company with its own books, its own data and its own address.: Full access, Read and edit, Read only or No access.
Roles
A team has exactly one owner. Any number of people can be admins or members.
| Owner | Admin | Member | |
|---|---|---|---|
| Open the team page | Yes | Yes | Yes, with less on it |
| Open the organizations of the team | All, with the access of the team | All, with the access of the team | The ones set for them, organization by organization |
| Invite members, set their access, remove them | Yes | Yes | No |
| Invite admins, change roles | Yes | No | No |
| Change the name and the logo of an organization the team owns, share it with other teams | Yes | Yes | No |
| Rename the team, change its logo, transfer the team | Yes | No | No |
An admin acts on members only. An admin cannot change the owner or another admin. The owner acts on everyone else in the team.
To make a member an admin, or an admin a member, the owner opens the menu of the person in the Users tab and selects Make admin or Make member.
Access levels
| Access level | What the person can do in the organization |
|---|---|
| Full access | Everything in Read and edit. The person can also change the reporting currency, the cost basis method and the fiscal year, change the name and the logo of the organization, share it with other teams, transfer its ownership, and allow AI clients in it. See Connect an AI client (MCP). |
| Read and edit | Read all the data. Change the accounting data and the preferences, except the reporting currency, the cost basis method and the fiscal year. |
| Read only | Read all the data. A notice on every page says that the person cannot change anything. |
| No access | The organization does not open, and it does not show in the list. |
Only the owner and the admins of the team that owns an organization get Full access to it. A member gets Read and edit at most.
Where the access of a person comes from
Two levels meet for each organization.
- The access of the team. The team that owns the organization has Full access to it. Another team has the access the owner team gave it: Read and edit or Read only.
- The access of the person in the team. The owner and the admins get the access of the team. A member gets the access set for them for that organization.
The person gets the lower of the two. A member set to Read and edit in an organization where the team has Read only gets Read only. For this reason, Read and edit cannot be picked where the team only reads.
If a person is in two teams that both reach the organization, the person gets the higher of the two results.
Default access
The access of a member is set organization by organization. Each organization can be Default, Read and edit, Read only or No access.
- Default access is Read and edit or Read only. An organization set to Default gives the member that level, where the team allows it. The list names the level it gives, for example "Default (Read only)".
- New organizations of the team decides what the member gets when the team gets a new organization:
- Get the default access: the new organization opens with the default access.
- No access until someone gives it: the new organization stays hidden from the member until an owner or an admin changes it.
The owner and the admins set these when they invite the member, and change them later with Edit access in the menu of the person. See Invite a user.
When a change applies
A change of access or role reaches every person within 5 minutes. This includes a person who has the organization open.
A change that lowers the access of a person asks you to confirm it first, and lists each level that goes down.