# Users and roles

Invite people to sign in to Prenso, choose their organisation role, and control which workspaces they reach.

There are two distinct groups of people in Prenso, and keeping them apart is the
single most useful thing to understand about access:

* **Organisation members** sign in to Prenso and plan the work. They are covered
  on this page.
* **Team members** deliver the work. They are records in a workspace, and
  adding one grants no access to anything. See
  [Team](/docs/workspaces/team).

The same person can be both — a volunteer coordinator who plans routes and
walks one. They are still two separate records: the organisation member
controls what they can sign in and see, and the team member records the
delivery work assigned to them.

## Organisation roles

Every member who can sign in holds one of three roles.

| Role       | What it can do                                                                                  |
| ---------- | ----------------------------------------------------------------------------------------------- |
| **Owner**  | Everything, including billing, deleting workspaces, and promoting admins. One per organisation. |
| **Admin**  | Manages the organisation and has manager access to every workspace.                             |
| **Member** | Reaches only the workspaces you grant, at the workspace role you choose.                        |

Owners and admins always reach every workspace as a manager. This isn't
configurable: an admin can grant themselves access to any workspace, so a
setting that hid one from them would not be an effective restriction.

## Workspace roles

Within a workspace, a member is either a **manager** or a **contributor**.

|                                        | Contributor | Manager                |
| -------------------------------------- | ----------- | ---------------------- |
| View maps, campaigns, and sites        | Yes         | Yes                    |
| Create and edit maps and routes        | Yes         | Yes                    |
| Create campaigns and assign deliveries | Yes         | Yes                    |
| Open the Team section                  | No          | Yes                    |
| Add and edit team members              | No          | Yes                    |
| Add and edit sites                     | No          | Yes                    |
| Change workspace settings              | No          | Admins and owners only |

Contributor is the right default for someone who plans and assigns routes.
Reserve manager for the people who own the team list and the signage inventory.

> **Contributors can assign work without seeing the team**
>
> The Team section is hidden from contributors entirely — no member list, no
> contact details, no delivery history. They can still pick a person when
> creating a delivery or naming a site owner, because that chooser needs only
> names. So a volunteer coordinator can hand out routes without having access to
> everyone's phone numbers and addresses.

## Inviting someone

Open the organisation from the workspace switcher, then **Members** in the
sidebar, and choose **Invite organisation member**. You set:

### Email address

The invitation is sent here. If they already have a Prenso account, accepting
adds your organisation to their account rather than creating a second one.

### Organisation role

**Admin** or **Member**. Only the owner can invite admins.

### Workspace access

For members, choose between:

* **All workspaces** — they reach every workspace, including ones created later,
  at a single default role.
* **Selected workspaces** — you pick the workspaces individually, and set the
  role separately for each. Someone can be a manager in one and a contributor in
  another.

Invitations expire, and you can revoke a pending one at any time from the
members list. Changing someone's access later takes effect immediately.

> **Good to know**
>
> A member set to **All workspaces** picks up new workspaces automatically. A
> member on **Selected workspaces** does not, which is usually what you want for
> a regional coordinator.

## Removing access

Removing a member from the organisation revokes their access to every workspace
under it. Their work stays — maps they drew, campaigns they created, routes they
assigned — because it belongs to the workspace, not to them.

Removing an organisation member does not remove any team member record they were
linked to. If they also delivered routes, archive that record separately from
[Team](/docs/workspaces/team).

## Next steps

- [Team](/docs/workspaces/team) — The people who deliver, and how they get their routes.

- [Workspaces](/docs/organisations/workspaces) — Decide how to divide your organisation.