Teams and Organizations
Understand workspace boundaries, member roles, invitations, team switching, and owner-managed identity organizations.
Canvas uses teams as workspace and data boundaries. Customers, invoices, transactions, documents, settings, and automation belong to the active team, and membership determines who can read or change that data.
The separate Organizations area is for owner-managed enterprise identity configuration such as company domains and single sign-on. It is related to a team record, but organization ownership and team membership are not interchangeable.
Team, Workspace, and Organization
| Term | What it means in Canvas |
|---|---|
| Team | The membership group and primary data-access boundary |
| Workspace | The active team whose data and settings are currently loaded |
| Organization | An owner-scoped enterprise identity record with optional domain, SSO, directory, role, and feature information |
Some screens use team, workspace, and company for the same active data boundary. Always confirm the active team before changing customer, billing, finance, or security data.
The Public badge on the team overview is a display label; it does not make team data publicly accessible. Application data remains membership-scoped.
Roles and Access
Canvas supports three team roles.
| Capability | Owner | Member | Viewer |
|---|---|---|---|
| Read team workspace data | Yes | Yes | Yes |
| Create or change normal team data | Yes | Yes | No |
| View member and pending-invite lists | Yes | Yes | Yes |
| Invite a Member | Yes | Yes | No |
| Invite an Owner | Yes | No | No |
| Remove a pending invite | Yes | Yes | No |
| Change member roles | Yes | No | No |
| Remove members | Yes | No | No |
| Manage workspace settings and billing | Yes | No | No |
| Delete the team | Yes | No | No |
The visible invite form offers Owner and Member. Existing Viewers can be displayed and retain read-only access, but the current member form does not offer Viewer as an invite or role-change choice.
Some write buttons can remain visible to a Viewer. The request is still refused by the access boundary. Treat the role, not button visibility, as authoritative.
Create a Workspace
From the team selector, choose Create team. The workspace form asks for:
- company name with at least two characters
- optional organization display name for identity and SSO
- country
- base currency
Team and organization names must be unique without regard to letter case. If the name is already used, choose another.
After creation, the creator becomes an Owner, the new team becomes active, and Canvas continues through MFA and onboarding setup. Default workspace folders and collections controls are provisioned in the background; their failure does not necessarily undo the team creation.
Base currency becomes the company's default for cross-currency views. Review it carefully before importing accounts or creating substantial billing history.
Switch and Review Teams
Open Settings → Account → Teams to see every team where your account has membership.
For each team:
- View switches to that workspace and opens its team overview
- Manage appears for Owners, switches to the workspace, and opens Settings
- Leave Team removes your membership after confirmation
The team overview shows the name, plan, base currency, country, creation date, team email and inbox address when available, members, pending invitations, and connected integrations.
The overview's Edit details control currently has no connected edit action. Use Manage and the relevant Settings page for supported changes.
Manage Members
Open Settings → Members.
Team Members
The member list shows each person's name, email, and role. Search is currently based on the member's name; searching only by email may not filter the list even though the email is displayed.
Owners can:
- promote a Member to Owner
- demote an Owner to Member when another Owner remains
- remove another member after confirmation
- leave the team when another Owner remains
Members and Viewers see roles as text and cannot change them. The current role selector exposes Owner and Member, not Viewer.
Pending Invitations
The pending list shows invite email and the role that will be granted on acceptance. Search filters by email.
Owners and Members can remove a pending invitation. Removal is immediate from the menu and has no confirmation dialog.
Invite People
Select Invite member from either member tab.
- Enter the person's exact sign-in email.
- Choose Member or Owner.
- Select Add more to prepare several invitations.
- Select Send invites.
- Confirm the success message and review Pending Invitations.
Permission rules still apply when the form offers a role:
- Owners can send Owner or Member invitations.
- Members can send Member invitations but an Owner invitation is rejected.
- Viewers cannot send invitations.
Inviting the same email to the same team updates the pending invite's role and inviter instead of creating another pending row.
The pending list does not show an expiration date and there is no resend action. To send a new invitation after correcting an address or delivery problem, remove the existing invite and create it again.
Accept or Decline an Invitation
Pending invitations for the authenticated email appear in the team selector and under Settings → Account → Teams.
- Accept creates membership with the invited role and consumes the invitation.
- Decline removes the invitation without creating membership.
Acceptance checks the invitation against the authenticated account's email. Use the exact email address that was invited. A user cannot accept an invitation issued to another email.
If the account already has membership, acceptance avoids adding a duplicate membership and still consumes the invitation.
Change Roles Safely
Role changes take effect immediately.
Before promoting someone to Owner, understand that they can manage workspace settings, billing, member roles, removals, and team deletion.
Before demoting an Owner:
- Confirm that another Owner exists.
- Confirm who will own billing and security work.
- Change the role.
- Refresh the member list and verify the result.
The current interface does not let the sole Owner demote themselves. The sole Owner also cannot leave the team.
Leave or Remove Access
Leave a team
Any member can choose Leave Team, but the final Owner is blocked until another Owner is assigned.
After leaving:
- the membership is removed
- the workspace can no longer be read or changed by that account
- if it was active, the active-team selection is cleared
- a new invitation is required to regain access
Remove a member
Only an Owner can remove another member. The action asks for confirmation and removes membership immediately. It does not delete the person's user account or their memberships in other teams.
Review ownership before removing an Owner. Canvas does not provide an approval or delay period for removal.
Manage Enterprise Organizations
Open Settings → Account → Organizations. This list includes organizations where the account is recorded as the organization owner; it is not a list of every team where the account has an Owner role.
Create an organization
The form asks for:
- organization name
- company domain
- optional URL slug
The domain must be a valid company domain. Personal-mail domains such as Gmail, Outlook, Yahoo, iCloud, and Proton are rejected. A custom slug must contain lowercase letters, numbers, and hyphens and be at least two characters. If a slug is already in use, Canvas generates a suffixed alternative.
Creating an organization cannot assign another user as its owner. The authenticated account becomes the recorded owner.
Organization creation and team membership are tracked separately. After creation, verify the resulting workspace under Settings → Account → Teams before expecting it in the team switcher.
Review organization status
The organization detail page can show:
- name, slug, creation date, and external identity ID
- SSO status
- domain verification status
- SSO connection count
- verified domains
- SSO connections
- directory-sync connections
- organization roles and permission counts
- identity feature flags
Only the recorded organization owner can load these details by slug. Other members receive an organization-not-found response rather than partial enterprise configuration.
Manage domains and SSO
When the enterprise identity integration is configured and an admin link can be generated:
- Domains → Manage opens domain verification in the external admin portal
- SSO → Configure opens SSO configuration
- Settings → Open admin portal opens the available SSO administration link
These links open a new browser tab and can be short-lived. Finish or restart the flow rather than sharing the link.
If the integration is unavailable, the organization still shows basic local details, while domains, SSO connections, directories, roles, feature flags, and admin links are empty. An empty section does not prove that a provider-side object has been deleted.
Destructive Boundaries
- Removing an invite prevents future acceptance but does not affect an existing member.
- Removing a member revokes that team's access but does not delete their account.
- Leaving a team affects only the current user.
- Deleting a team is Owner-only and permanently cascades through team data. External cleanup is queued after deletion and is best effort.
- There is no team archive or restore flow in the current product.
Troubleshooting
I can see Invite member but sending fails
Check your role. Viewers cannot write, and Members cannot grant the Owner role. Ask an Owner when the invitation requires Owner access.
A pending invitation is not visible to the recipient
Confirm the exact sign-in email, including letter case, then remove and recreate the invite if necessary. The list has no resend action or visible expiration.
I cannot change my own role
The sole Owner cannot self-demote. Promote another trusted member to Owner first.
I cannot leave the team
The final Owner is required to remain. Assign another Owner, verify the role change, then leave.
Searching members by email returns no result
Search by the member's display name. The member table currently filters the name field even though email is shown.
The organization has no domain or SSO controls
The enterprise identity integration or portal link may be unavailable. Basic organization details can exist without provider-backed controls.
An Owner workspace is missing from Organizations
The Organizations page uses the recorded organization-owner field, not membership role alone. Manage normal workspace membership under Settings → Account → Teams.