> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.pivotal.app/llms.txt.
> For full documentation content, see https://docs.pivotal.app/llms-full.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pivotal.app/_mcp/server.

# Roles and permissions

Pivotal ships with three workspace-wide roles: **Owner**, **Admin**, and **Member**. A teammate has exactly one role. The role controls what they can change at the workspace level. Access to individual customers, onboardings, and tasks layers on top via the customer record's **Access** tab.

## The permission matrix

| Capability                            | Owner | Admin | Member |
| ------------------------------------- | :---: | :---: | :----: |
| View customers they're assigned to    |  yes  |  yes  |   yes  |
| View all customers                    |  yes  |  yes  |   no   |
| Create, edit, archive customers       |  yes  |  yes  | scoped |
| Create, edit, complete tasks          |  yes  |  yes  |   yes  |
| Move onboardings between phases       |  yes  |  yes  |   yes  |
| Edit phase templates                  |  yes  |  yes  |   no   |
| Invite, change role of teammates      |  yes  |  yes  |   no   |
| Connect or disconnect integrations    |  yes  |  yes  |   no   |
| Edit branding, portal, workspace name |  yes  |  yes  |   no   |
| View billing, change plan, swap card  |  yes  |  yes  |   no   |
| Transfer ownership                    |  yes  |   no  |   no   |
| Delete the workspace                  |  yes  |   no  |   no   |

"Scoped" means a Member can edit a customer they've been granted access to, but can't create new customers or see ones they weren't assigned.

## Picking the right role

**Owner** is the billing and legal contact. Exactly one per workspace. Use the human who signs the renewal. Transfer it before they leave the company; you can't transfer ownership of a workspace you no longer have access to.

**Admin** is your CS leadership tier. Heads of CS, ops, and the implementation lead. Admins do everything except billing-account-level destructive actions. Most workspaces run with two to four Admins.

**Member** is the working tier. CSMs, AMs, and implementation engineers. They see the customers assigned to them on the Workbench. To widen their view, open the customer record, click **Access**, and add them. To open every customer to every Member, flip **Admin > Workspace settings > Default access** to "All Members".

## Per-customer access

The customer record's **Access** tab overrides workspace defaults in one direction: it can grant a Member visibility to a customer they wouldn't otherwise see. It cannot demote an Admin or hide a customer from someone who already has workspace-wide visibility. Use it when a Member needs to collaborate on a customer outside their book.

## Edge case

A Member promoted to Admin keeps every customer-level access grant. Demoting back to Member does not strip those grants; the Access tab still lists them. If you need a clean slate, open each customer record and remove the access manually, or email [help@pivotal.app](mailto:help@pivotal.app) to bulk-clear.

## Related

* [Invite your team](/product/setup/invite-your-team)
* [Plans and seats](/product/setup/plans-and-seats)
* [Edit customer details](/product/customers/edit-customer-details)

Email **[help@pivotal.app](mailto:help@pivotal.app)** with a screenshot of where you got stuck and the customer or onboarding id from the URL.