docs

Assign and change roles

Only accounts with the admin tenant role can change other members' roles. This page covers the three ways roles are granted in not24get: at invite time, after the fact through the members list, and by adding the member to a group.

Assign a role at invite time

The invitation flow is the most common way to grant a role. The invitee accepts, sets a password, and joins the tenant with the role you chose.

  1. Open the Members page (`/invite`)

    As a tenant admin, open Members (/invite) from the bookmark hub organization area.

  2. Choose the invitation scope

    • Workspace — the invitee joins a single workspace. - Organization — the invitee joins the whole tenant and can see every workspace they are added to.

  3. Pick the tenant role

    Choose admin, member, or support. Members with the admin role on the tenant gain billing access automatically.

  4. (Optional) attach a custom RBAC role

    If your tenant has custom roles, pick one from the RBAC role dropdown. Custom roles add permissions on top of the tenant role; they do not replace it.

  5. Send the invitation

    The invitee receives an email with a sign-up link. Once they accept, the membership is created with status active.

Change a role or workspace access on an existing member

Tenant admins do this on the Members page at /invite (organization context in the bookmark hub), not only at invite time.

  1. Open Members (`/invite`)

    Sign in as a tenant admin and open Members (/invite).

  2. Find the member

    Scroll Current members. Each row shows email, display name, the current tenant role badge, Workspace access: X of Y, and (for admins) Configure access.

  3. Open Configure access

    Click Configure access for the person you want to update.

  4. Set organization role and optional workspace grant

    Choose Organization role (admin, member, or support). That value is written to every active workspace membership they have in this tenant. If Grant access to all workspaces appears (when they have fewer memberships than workspaces), enable it and save to add memberships on the missing workspaces.

  5. Save

    Click Save changes. The server returns success immediately. The member’s JWT tenant role updates on next refresh (interactive refresh uses membership from the database).

Use groups for bulk assignment

Groups let you grant the same custom RBAC role to many accounts at once. Members inherit every role attached to the group, and the change takes effect on the member's next request — there is no session refresh and no waiting on a background job.

The Roles & permissions page lives at Settings → Roles & permissions (/settings/roles). It is gated to the admin tenant role; member and support cannot reach it.

Create a group

  1. Open Settings → Roles & permissions

    From the workspace shell, open Settings → Roles & permissions. Scroll to the Groups section.

  2. Click Create group

    Give the group a Name (must be unique within the tenant) and an optional Description. Save the dialog.

  3. Confirm it appears in the table

    The new group shows up in the Groups table with zero members and zero role assignments.

Attach a custom role to a group

  1. Open the Role assignments to groups section

    Below the Groups table, find Role assignments to groups.

  2. Pick the group and the role

    Choose a group from the Group dropdown and a custom RBAC role from the Role dropdown. Optionally set the scope (organization, organization unit, or workspace) — this controls where the inherited role applies.

  3. Click Assign role

    The assignment appears in the list. Every member of the group gains the role's permissions on their next request.

Add or remove members

  1. Open the Group members section

    On the same page, scroll to Group members and pick the group from the dropdown. The current members are listed.

  2. Add a member

    Search for an account by email or display name in the autocomplete and click Add member. Repeat for each account you want to enroll.

  3. Remove a member

    Click Remove in the member's row. The account loses every permission it inherited from the group on its next request, but its tenant membership and any directly assigned roles are untouched.

Edit or delete a group

  1. Edit the name or description

    Click the pencil icon in the Groups table. Saving the dialog updates the group in place; existing memberships and role assignments are preserved.

  2. Delete the group

    Click the trash icon. Confirm the prompt — the group, all of its memberships, and all of its role assignments are removed in a single operation.

Revoke access

Revoking a membership is a soft action — it sets the membership status to revoked without deleting the account. The user keeps their bookmarks and personal data but loses access to this tenant until you reactivate them.

  1. Open the member's row in Members

    Find the member in Workspace settings → Members.

  2. Choose Revoke access

    Use the row's overflow menu and select Revoke access. Confirm the prompt.

  3. (Later) reactivate if needed

    A revoked member can be restored from the same overflow menu — their previous role is preserved.

Folder access is separate

Changing a tenant role does not change folder share access. To remove someone's read or read/write access to a specific folder, open the folder's Share dialog and remove their entry there. See Share a folder in read-only mode for the share-side flow.

What's next