Manage Team Access

Invite teammates, assign roles, verify acceptance, switch workspaces, and remove access without leaving a team ownerless.

Use this workflow when adding a teammate, transferring ownership, reviewing pending invitations, or removing access. Team membership is the boundary for customer, invoice, finance, document, and settings data, so role changes should be treated as security changes.

Before You Start

Select the team you intend to manage.
Open Settings → Members.
Confirm your own role in Team Members.
Decide whether the person needs write access or full ownership.
Have the exact email address they use to sign in.

Choose the Right Role

Role	Use when
Owner	The person must manage settings, billing, roles, removals, security, and team deletion
Member	The person needs normal read and write access to workspace data
Viewer	The person needs read-only access; existing Viewers are supported, but the current invite form does not offer this role

Grant Owner only to people who should control billing and security. Owner access takes effect as soon as the invitation is accepted or the role is changed.

1. Review Current Ownership

Select Team Members.
Search for the current Owners by name.
Count how many Owners remain.
Confirm which Owner is responsible for billing and security.

Do this before demoting, removing, or asking an Owner to leave. The last Owner cannot leave through the product.

2. Invite One or More People

Select Invite member.
Enter the first person's exact sign-in email.
Choose Member or Owner.
Select Add more for each additional person.
Review every email and role.
Select Send invites.
Confirm the success message reports the expected invite count.

Owners can invite Owners or Members. Members can invite Members, but an attempt to grant Owner is rejected. Viewers cannot send invitations.

3. Verify Pending Invitations

Select Pending Invitations.
Search by email.
Confirm each invitation shows the intended role.
If the email or role is wrong, open its menu and select Remove.
Create a replacement invitation with the corrected values.

Removing a pending invite is immediate and has no confirmation step. It affects only the invitation; it does not remove a person who already accepted.

Sending another invite to the same email and team updates the existing pending invitation rather than creating a duplicate.

4. Have the Recipient Accept

Ask the recipient to sign in with the invited email and open the team selector or Settings → Account → Teams.

They can choose:

Accept to join with the assigned role
Decline to remove the invitation

Acceptance consumes the invitation and creates team membership. It is restricted to the authenticated email, so forwarding the invite does not transfer access to another account.

The pending list has no visible expiry or resend action. If the invitation does not arrive, verify the email, remove the row, and send a new invitation.

5. Verify Membership

After acceptance:

Refresh Settings → Members.
Search by the person's display name.
Confirm the email and role.
Ask the person to switch to the team.
Have them verify an appropriate read or write action for their role.

The member search currently filters by display name rather than email. If email search returns no row, search the person's name or scan the list.

6. Change a Role

Only an Owner can change roles.

Find the member.
Open the role selector.
Choose Owner or Member.
Wait for the list to refresh.
Verify the new role.

The current selector does not offer Viewer. Existing Viewer memberships remain read-only, but converting someone to or from Viewer requires a supported administrative path outside this screen.

Transfer practical ownership

Promote the new responsible person to Owner.
Verify that they can open team Settings.
Confirm they understand billing and security responsibilities.
Demote the previous Owner to Member if appropriate.
Recheck that at least one Owner remains.

Role changes are immediate and do not require the affected person's approval.

7. Remove a Member

Only an Owner can remove another member.

Confirm the team and member identity.
Review whether the member is an Owner.
Transfer any operational ownership before removal.
Open the member's action menu.
Select Remove Member.
Confirm the dialog.
Refresh the list and verify the member is gone.

Removal revokes this team's membership. It does not delete the user's account, their work history, or memberships in other teams.

8. Leave a Team

Open Settings → Account → Teams or use your own row under Settings → Members.

Choose Leave Team.
Review the warning.
Confirm.

After leaving, you need a new invitation to regain access. If the team was active, Canvas clears that active-team selection.

The last Owner cannot leave. Promote another person to Owner first, then verify the promotion before retrying.

9. Switch or Manage Another Team

Open Settings → Account → Teams.

Select View to switch the active workspace and open its overview.
If you are an Owner, select Manage to switch the workspace and open its Settings.

Always wait for the workspace switch to finish before changing members or data. The page can show multiple teams, but write operations apply to the active team context.

10. Review Enterprise Organization Access

Normal team role management happens under Members. Enterprise domain and SSO details are under Settings → Account → Organizations and are visible only to the recorded organization owner.

An account with the team role Owner is not automatically listed as the recorded organization owner. If the organization is missing, manage membership in Teams and ask the recorded owner to manage domain or SSO configuration.

When provider-backed admin links are available, they open an external portal for domain verification and SSO. Do not share those session links as a substitute for granting the correct team role.

Access Review Checklist

The active team is correct.
Every Owner still needs full administrative control.
At least one trusted Owner remains.
Members have write access only where required.
Existing Viewers remain appropriate for read-only access.
Pending invitations use exact sign-in emails.
No stale or mistaken invitations remain.
Departed people are removed from membership.
Enterprise identity access is managed by the recorded organization owner.

Troubleshooting

Send invites fails for an Owner role

Only an existing Owner can invite another Owner. If you are a Member, send a Member invitation or ask an Owner.

Send invites fails even for a Member role

Confirm that you are not a Viewer and that the correct team is active. Viewers can read the member page but cannot write.

The recipient cannot see or accept the invite

Compare the invite email with the authenticated account email exactly. Remove and recreate the invite if the address or capitalization is wrong.

The invitation email did not arrive

Check the pending row first. If it exists, remove it and send a new invite. There is no resend control in the current interface.

I cannot find a member by email

Search their display name. Email is displayed but is not part of the current member-table filter.

I cannot select Viewer

The current visible role selector offers only Owner and Member. Existing Viewer access remains read-only, but the screen does not provide Viewer assignment.

I cannot demote myself

If you are the only Owner, promote another trusted member first. Self-demotion becomes available only when another Owner remains.

I cannot leave

The final Owner cannot leave. Assign another Owner and verify the role change before trying again.

A removed member still appears active elsewhere

Refresh the member list and confirm the correct team. Removal affects this team only; the person's user account and other team memberships remain valid.