User roles & permissions

Each organisation has one Owner — whoever created it, unless ownership has since been transferred (a client your MSP created belongs to your MSP's owner) — then Admins and Members (Settings → Members). Admins manage members, branding, custom data, integrations, alert rules and the audit trail. Members are read-only: they can see everything, run reports, subscribe to calendar feeds and work alerts, but can't add, change or delete anything (on a client you manage, its read-only contacts only view alerts). A handful of things are owner-only: the organisation's name, photo and point of contact, its currency, the expiry lead time, device lifecycle, spares tracking, automatic deletion of former people, import and export, transferring ownership and closing the organisation. On a client you manage, your MSP's owners and admins hold these too. The owner can't be removed or have their role changed by anyone. On an MSP workspace the roles are Admin, Tech and User instead: Owner and Admin always reach every managed client, including ones added later, while Techs and Users are scoped to a named list of clients, enforced on the server rather than just hidden in the UI. A Tech manages the clients assigned to them, and the workspace's own data but not its settings; a User is the read-only seat — they see their assigned clients and can generate reports across them (including the Fleet dashboard, narrowed to those clients) but change nothing. On an MSP workspace's Members page, "What can each role do?" lays the staff roles out side by side, and a Tech or User sees a Your access card listing their role, the clients they reach and which admins to ask for more. On a managed client's Members page, an Access via <MSP> section shows who reaches the client through the MSP — to MSP staff with each person's reason (Sees every client, or Assigned to this client) and a Manage access button.