How team roles and permissions work

Every person in BrandOps holds exactly one of four roles, ranked in this order everywhere the app sorts a team list: Owner, Admin, Member, Viewer.

• Owner: the top role. Full control of the workspace including billing. There's exactly one, and their row never shows a Remove option.
• Admin: can manage team members, send invites, and edit workspace or brand settings, but doesn't carry the irrevocable status an Owner has.
• Member: full access to create and edit data (tasks, content, clients, whatever your business type exposes) but can't touch team membership.
• Viewer: read-only. Can look at everything but can't create or change anything, and the app tells them so directly on the Team tab.
• These same four roles and the same ranking apply whether you're looking at organization-wide admins or a single brand's team.

BrandOps splits team management into two separate places on purpose, because access to "everything" and access to "one brand" are genuinely different grants.

• Organization → Team (at /dashboard/organization?tab=team) lists your org-wide admins: every member with the Owner or Admin role. Its subheading says exactly what they get: full access to every brand in your workspace, plus billing.
• Settings → Team (at /dashboard/settings?tab=team) is scoped to whichever brand you currently have selected. It lists that brand's own team plus, read-only, any org Owner or Admin, labelled with an "Org" prefix on their role badge, since they already have implicit access without needing a separate grant.
• A brand invite only ever offers Admin, Member, or Viewer for that one brand. There's no way to invite someone as a brand-level Owner; Owner is an organization-wide role.
• If you're running a single brand, this distinction barely matters day to day. It matters a lot once you're on Agency and running multiple brands from one organization; see the Multi-Brand guide.

Invites work the same way in both places: pick an email, pick a role, send it. Only Owners and Admins see the Invite button.

• An org invite (sent from Organization → Team) offers Admin, Member, or Viewer, and grants access across the whole workspace.
• A brand invite (sent from Settings → Team) offers the same three roles but grants access to that one brand only.
• Pending invites show up in their own list with who sent them and when, so you can see what's outstanding before someone accepts.
• An Owner or Admin can revoke any pending invite before it's accepted, right from that same list.
• You can change someone's role later; it isn't locked in at invite time.

Removing someone is a per-row action on the team list, gated the same way invites are.

• Only Owners and Admins can remove people, and a confirmation step (Remove / Cancel) appears before it's final.
• You can never remove the Owner, and you can never remove yourself from a team list. Both are blocked outright.
• Removing someone from a brand's team only revokes that brand's access. If they're also an org Owner or Admin, they'll still show up as an implied admin, because that access comes from the organization, not the brand.
• Removal is immediate. There's no offboarding delay or grace period.