People, roles and client groups

A workspace holds four roles:

• Owner holds the plan and is the only one who can change it.
• Admin runs the workspace: people, settings, policy.
• Member does the work: jobs, site changes, reports.
• Viewer opens every site and every record and presses nothing.

Viewer is the seat you give a client. An invitation that has not been accepted yet still holds a seat. Removing somebody ends their access to every site in the workspace and disconnects their AI apps in the same moment.

Client groups

A client group is the customer. Filter the site list by it, point a whole job at it, and write the month’s report for it. A batch of new sites can join a group as it connects.

Single sign-on

Connect Google Workspace, Microsoft Entra, Okta or any OpenID Connect provider to a workspace. Only the owner can connect one, and only for an email domain they have proved with a DNS record. Once it is required, a password sign-in on that domain is refused and sent to the provider instead. A provider speaks for its own domain and for no other.

Activity

Every change is recorded with the time, the site, what was done, who did it, the level it ran at and how it ended. A person, a job and an AI app read the same way, because when a client asks who changed the front page the answer has to be able to be any of the three. Refused calls are recorded too. Filter by site, client group, person, outcome and date, and export CSV or JSON. Records are kept 400 days.