diff --git a/content/docs/bases/base-collaboration.mdx b/content/docs/bases/base-collaboration.mdx index 219f86fa..ce1168d9 100644 --- a/content/docs/bases/base-collaboration.mdx +++ b/content/docs/bases/base-collaboration.mdx @@ -1,48 +1,118 @@ --- title: 'Base collaboration' -description: 'Invite team members to work on a base' -tags: ['Bases', 'Collaboration', 'Members', 'Invite', 'Roles', 'Permissions'] -keywords: ['NocoDB base', 'base collaboration'] +description: 'This article explains how to invite members or teams to your base, manage their roles, and remove them when needed.' +tags: ['Collaboration', 'Bases', 'Members', 'Teams', 'Invite', 'Roles', 'Permissions'] +keywords: ['Invite members', 'Invite teams', 'Member roles', 'Team roles', 'Base access', 'Displaying base members', 'Displaying base teams', 'Modifying roles', 'Removing members', 'Removing teams', 'Base collaboration', 'Base permissions'] --- -In NocoDB, a member added to a workspace inherits their role-based permissions across all bases within that workspace. If you need to override a member’s permissions for a specific base, follow the steps below: +A comprehensive guide regarding roles and permissions can be accessed [here](/docs/product-docs/roles-and-permissions) +Teams feature availability: **Business** plan onwards in cloud and On-premise **Enterprise** edition -## Update members role in your base +## Invite Members to Base -1. Access `Base Dashboard` from the left sidebar -2. Navigate to the `Members` tab. -3. Locate the user whose access you want to change. -4. Use the dropdown to assign a new role specific to this base. +Base-level member management allows you to control granular access to specific bases within your workspace. You can invite individual members directly to a base with specific role assignments. -![image](/img/v2/base/base-collaboration.png) +1. Navigate to the **Overview** > **Members** tab within your base. +2. Click **Add Members**. +3. Enter one or more email addresses (comma-separated). +4. Select a role for the invited member(s) from the dropdown menu. +5. Click **Invite to Base**. +You can only assign roles that are at most equal to your own role on the base. - Any existing user can invite members to the base, but they can only assign roles that are equal to or lower than their own role. Only the base owner / creator can change the role of a base member. +You can invite multiple members simultaneously by entering their email addresses separated by commas. -More details about roles & permissions can be found [here](/docs/product-docs/roles-and-permissions). +![image](/img/v2/collaboration/base/base-add-members-1.png) +![image](/img/v2/collaboration/base/base-add-members-2.png) -## Remove members from your base -1. Access `Base Dashboard` from the left sidebar -2. Navigate to the `Members` tab. -3. Locate the user to remove. -4. Set their role to No Access using the dropdown. +Members added to a workspace inherit the role assigned at the workspace level, unless a specific role is configured at the base level. Alternatively, you can invite users directly to a base with restricted workspace access. This allows you to grant access to a single base without exposing other workspace data — ideal for collaborating with external partners, clients, or temporary contributors in a controlled manner. -![image](/img/v2/base/base-collaboration.png) -Removing a member from a base does not delete their account. They can still access other bases in the workspace, unless removed from the workspace entirely. +## Invite Teams to Base ☁ -## Direct base invite +You can assign entire teams to a base for streamlined collaboration. Teams inherit the base-level role assigned to them, making it easier to manage access for department-wide or functional group permissions. -In addition to inviting workspace members to a base, you can invite users directly to a specific base (with restricted workspace access). This is useful when you want to grant someone access to only a single base without exposing the rest of the workspace. +1. Navigate to the **Overview** > **Members** tab within your base. +2. Click on the **Add Teams** button. +3. From the dropdown, select one or multiple teams to add to the base. Teams already added to the base will be indicated as disabled in the dropdown. +4. Choose the appropriate base-level role from the dropdown menu. Note that: + - Similar to individual members, you can only assign roles that are at most equal to your own role on the base. + - Teams can't be assigned the **Owner** role at the base level. +5. Click on the **Add Teams** button to complete the process. -When a user is invited directly to a base: +When a team is invited to the base, all users under that team inherit the assigned base-level role unless overridden by an individual explicit member role. -* They are automatically added to the parent workspace with the **No Access** role. -* Their access is restricted exclusively to the base they were invited into. -* They will not be able to view or access any other bases, tables, or data within the same workspace. -* Their name will still appear in the workspace’s member list, but their visibility and access will be limited. +![image](/img/v2/collaboration/base/base-add-teams-1.png) +![image](/img/v2/collaboration/base/base-add-teams-2.png) -This approach is ideal for sharing specific projects with external collaborators, clients, or temporary contributors without compromising workspace-level visibility. +To learn more about creating and managing teams, refer to the [Teams documentation](/docs/product-docs/collaboration/teams). + +Teams added to a workspace inherit the role assigned at the workspace level, unless a different role is configured at the base level. Alternatively, you can invite teams directly to a base with restricted workspace access. This allows team members to collaborate on a specific base without access to other workspace data — ideal for engaging external teams, partner organizations, or temporary project groups securely and efficiently. + +## List Base Members and Teams + +The `Members` tab displays all users and teams that have access to the base. + +- Individual members appear with their email addresses and assigned base role. +- Teams are listed with their name, member count, and assigned base role. + +![image](/img/v2/collaboration/base/base-members-list.png) + +Inherited roles from workspace-level are displayed with `workspace` suffix to indicate their origin. + + +## Modify Roles for Members or Teams + +Access permissions for both members and teams can be updated directly from the `Members` tab. + +1. Click on the role dropdown next to the member or team. +2. Select a new role from the list of available options. +3. The role change takes effect immediately. + +![image](/img/v2/collaboration/base/base-edit-roles.png) + +You can only assign roles that are at most equal to your own role on the base. Teams cannot be assigned the **Owner** role at the base level. + +Learn more about [roles and permissions](/docs/product-docs/roles-and-permissions). + + +## Role Precedence + +When a user has multiple role assignments through both team and individual access at the base level, NocoDB resolves the final permission using a clear precedence order. + +- Individual explicit role takes precedence over team-assigned role. +- Base-level roles override workspace-level roles. +- In case of multiple team roles, the **highest** permission applies. + +Learn more about [roles and permissions](/docs/product-docs/collaboration/teams#effective-role-resolution). + +## Remove or Revoke Base Access +There are two ways to manage member or team access to a base: + +### Deny Access +To prevent a user or team from accessing the base: +- Click on the role dropdown next to the member or team entry. +- Select `No Access` from the available roles. + +The member or team will be blocked from accessing this base, regardless of their workspace or team-level permissions. + +### Revoke Explicit Assignment +To remove an explicit base-level role assignment and allow the user to inherit their workspace or team-level role: +- Click on the role dropdown next to the member or team entry. +- Select `Inherit` from the available roles. + +The member or team will now access the base based on their workspace-level or team-level permissions, rather than an explicit base-level assignment. + +Use **No Access** to explicitly block someone from a base. Use **Inherit** to remove the base-level assignment and fall back to workspace or team inheritance. + +## Best Practice + +- Use base-level permissions to restrict access to sensitive data while maintaining broader workspace access. +- Assign teams to bases for departments or functional groups to manage access efficiently without individual invitations. +- Start by inviting teams to bases when possible, then add individual members for exceptions. +- Regularly audit base member lists to ensure access remains appropriate as team compositions change. + +Learn more [here](/docs/product-docs/collaboration/teams#best-practices). --- \ No newline at end of file diff --git a/content/docs/collaboration/base-collaboration.mdx b/content/docs/collaboration/base-collaboration.mdx index c6c197d5..b02f9bf3 100644 --- a/content/docs/collaboration/base-collaboration.mdx +++ b/content/docs/collaboration/base-collaboration.mdx @@ -1,33 +1,118 @@ --- title: 'Base collaboration' -description: 'Invite team members to work on a base' -tags: ['Collaboration', 'Bases', 'Members', 'Invite', 'Roles'] -keywords: ['NocoDB base', 'base collaboration', 'base context menu', 'base owner', 'base settings'] +description: 'This article explains how to invite members or teams to your base, manage their roles, and remove them when needed.' +tags: ['Collaboration', 'Bases', 'Members', 'Teams', 'Invite', 'Roles', 'Permissions'] +keywords: ['Invite members', 'Invite teams', 'Member roles', 'Team roles', 'Base access', 'Displaying base members', 'Displaying base teams', 'Modifying roles', 'Removing members', 'Removing teams', 'Base collaboration', 'Base permissions'] --- -## Inviting members to your base -When a member is added to a workspace, they will carry their assigned role-specific permissions to all the bases within the workspace. To override member permissions to your base, please follow steps outlined below: +A comprehensive guide regarding roles and permissions can be accessed [here](/docs/product-docs/roles-and-permissions) -1. Go to the left sidebar and select `Base name` to access the `Base Dashboard.` -2. Click on the `Members` tab. -3. Use the dropdown menu to specify the access permissions for the member you wish to collaborate. -4. Finalize the process by assigning the desired role to the user. +Teams feature availability: **Business** plan onwards in cloud and On-premise **Enterprise** edition -![image](/img/v2/base/base-collaboration.png) +## Invite Members to Base - -- Any existing user can invite members to the base, but they can only assign a role to new members that is at most equal to their own role. -- Only the base owner / creator can change the role of a base member. - +Base-level member management allows you to control granular access to specific bases within your workspace. You can invite individual members directly to a base with specific role assignments. -More details about roles & permissions can be found [here](/docs/product-docs/roles-and-permissions). +1. Navigate to the **Overview** > **Members** tab within your base. +2. Click **Add Members**. +3. Enter one or more email addresses (comma-separated). +4. Select a role for the invited member(s) from the dropdown menu. +5. Click **Invite to Base**. -## Removing members from your base -1. Go to the left sidebar and select `Base name` to access the `Base Dashboard.` -2. Click on the `Members` tab. -3. Use the dropdown menu to specify the access permissions for the member you wish to collaborate. -4. Assign the `No Access` role to the user. +You can only assign roles that are at most equal to your own role on the base. -![image](/img/v2/base/base-collaboration.png) +You can invite multiple members simultaneously by entering their email addresses separated by commas. +![image](/img/v2/collaboration/base/base-add-members-1.png) +![image](/img/v2/collaboration/base/base-add-members-2.png) +Members added to a workspace inherit the role assigned at the workspace level, unless a specific role is configured at the base level. Alternatively, you can invite users directly to a base with restricted workspace access. This allows you to grant access to a single base without exposing other workspace data — ideal for collaborating with external partners, clients, or temporary contributors in a controlled manner. + + +## Invite Teams to Base ☁ + +You can assign entire teams to a base for streamlined collaboration. Teams inherit the base-level role assigned to them, making it easier to manage access for department-wide or functional group permissions. + +1. Navigate to the **Overview** > **Members** tab within your base. +2. Click on the **Add Teams** button. +3. From the dropdown, select one or multiple teams to add to the base. Teams already added to the base will be indicated as disabled in the dropdown. +4. Choose the appropriate base-level role from the dropdown menu. Note that: + - Similar to individual members, you can only assign roles that are at most equal to your own role on the base. + - Teams can't be assigned the **Owner** role at the base level. +5. Click on the **Add Teams** button to complete the process. + +When a team is invited to the base, all users under that team inherit the assigned base-level role unless overridden by an individual explicit member role. + +![image](/img/v2/collaboration/base/base-add-teams-1.png) +![image](/img/v2/collaboration/base/base-add-teams-2.png) + +To learn more about creating and managing teams, refer to the [Teams documentation](/docs/product-docs/collaboration/teams). + +Teams added to a workspace inherit the role assigned at the workspace level, unless a different role is configured at the base level. Alternatively, you can invite teams directly to a base with restricted workspace access. This allows team members to collaborate on a specific base without access to other workspace data — ideal for engaging external teams, partner organizations, or temporary project groups securely and efficiently. + +## List Base Members and Teams + +The `Members` tab displays all users and teams that have access to the base. + +- Individual members appear with their email addresses and assigned base role. +- Teams are listed with their name, member count, and assigned base role. + +![image](/img/v2/collaboration/base/base-members-list.png) + +Inherited roles from workspace-level are displayed with `workspace` suffix to indicate their origin. + + +## Modify Roles for Members or Teams + +Access permissions for both members and teams can be updated directly from the `Members` tab. + +1. Click on the role dropdown next to the member or team. +2. Select a new role from the list of available options. +3. The role change takes effect immediately. + +![image](/img/v2/collaboration/base/base-edit-roles.png) + +You can only assign roles that are at most equal to your own role on the base. Teams cannot be assigned the **Owner** role at the base level. + +Learn more about [roles and permissions](/docs/product-docs/roles-and-permissions). + + +## Role Precedence + +When a user has multiple role assignments through both team and individual access at the base level, NocoDB resolves the final permission using a clear precedence order. + +- Individual explicit role takes precedence over team-assigned role. +- Base-level roles override workspace-level roles. +- In case of multiple team roles, the **highest** permission applies. + +Learn more about [roles and permissions](/docs/product-docs/collaboration/teams#effective-role-resolution). + +## Remove or Revoke Base Access +There are two ways to manage member or team access to a base: + +### Deny Access +To prevent a user or team from accessing the base: + - Click on the role dropdown next to the member or team entry. + - Select `No Access` from the available roles. + +The member or team will be blocked from accessing this base, regardless of their workspace or team-level permissions. + +### Revoke Explicit Assignment +To remove an explicit base-level role assignment and allow the user to inherit their workspace or team-level role: + - Click on the role dropdown next to the member or team entry. + - Select `Inherit` from the available roles. + +The member or team will now access the base based on their workspace-level or team-level permissions, rather than an explicit base-level assignment. + +Use **No Access** to explicitly block someone from a base. Use **Inherit** to remove the base-level assignment and fall back to workspace or team inheritance. + +## Best Practice + +- Use base-level permissions to restrict access to sensitive data while maintaining broader workspace access. +- Assign teams to bases for departments or functional groups to manage access efficiently without individual invitations. +- Start by inviting teams to bases when possible, then add individual members for exceptions. +- Regularly audit base member lists to ensure access remains appropriate as team compositions change. + +Learn more [here](/docs/product-docs/collaboration/teams#best-practices). + +--- \ No newline at end of file diff --git a/content/docs/collaboration/index.mdx b/content/docs/collaboration/index.mdx index f8f03da4..8840a60d 100644 --- a/content/docs/collaboration/index.mdx +++ b/content/docs/collaboration/index.mdx @@ -6,9 +6,9 @@ keywords: ['Collaboration overview'] icon: "users" --- -At NocoDB, our passion lies in promoting teamwork, and it's a significant factor contributing to our popularity. Through NocoDB's collaborative functionalities, you have the ability to foster effective task distribution and team communication by extending invitations to others for seamless cooperation. +At NocoDB, teamwork is at the core of what we do. Our collaboration features make it easy to share work, assign tasks, and communicate effectively with your team. -In this segment, we'll discuss various collaboration features that NocoDB offers. +In this section, we’ll explore the different collaboration tools available in NocoDB. [Workspace collaboration](/docs/product-docs/collaboration/workspace-collaboration) [Base collaboration](/docs/product-docs/collaboration/base-collaboration) diff --git a/content/docs/collaboration/meta.json b/content/docs/collaboration/meta.json index 83182616..ad2baa0e 100644 --- a/content/docs/collaboration/meta.json +++ b/content/docs/collaboration/meta.json @@ -3,6 +3,7 @@ "pages": [ "workspace-collaboration", "base-collaboration", + "teams", "share-base", "share-view", "notifications", diff --git a/content/docs/collaboration/teams.mdx b/content/docs/collaboration/teams.mdx new file mode 100644 index 00000000..d3b7074d --- /dev/null +++ b/content/docs/collaboration/teams.mdx @@ -0,0 +1,143 @@ +--- +title: "Teams" +description: "Manage groups of users with role-based access to workspaces & bases" +tags: ["Collaboration", "Teams", "User Management", "Roles & Permissions"] +keywords: ["NocoDB teams", "user groups", "role-based access", "workspace collaboration", "base permissions"] +--- + +Availability: **Business** plan onwards in cloud and On-premise **Enterprise** edition + +## Overview + +Teams let you group existing workspace members, so you can assign and manage permissions at scale. Instead of configuring the same role for each person on every base, add users to a team and grant that team a role on one or more bases. + +Teams help you to +- **Organize** members by department, project, or function +- **Manage permissions** efficiently by assigning roles to teams instead of individuals +- **Scale access control** without managing individual user permissions +- **Maintain flexibility** with inheritance and override capabilities + + +## Create Team + +1. Navigate to **Workspace Settings** > **Teams** tab. +2. Click **New Team**. +3. Enter a team name (Optional). +4. Click **Create Team**. + +![Create Team](/img/v2/collaboration/teams/create-team-1.png) +![Create Team](/img/v2/collaboration/teams/create-team-2.png) + +When a team is created, the creator is automatically added as its first member and designated as the **Team Owner**. Team Owners have full administrative privileges, including adding or removing members, renaming the team, and deleting it when necessary. Multiple owners can be assigned to a team, but each team must always have at least one owner. + +## Add Members to a Team + +In the **Teams** tab, select the team you want to manage, then follow these steps: + +1. Click **Add Members**. +2. Use the toggle buttons to select existing workspace members to add. Members already part of the team are clearly indicated. +3. Click **Add Members** again to confirm your selection. + +You can search by name or email to quickly locate users. Existing team members have their toggles disabled to avoid duplicate additions. Each member’s workspace role is displayed beside their name for better context. + +![Add Members to Team](/img/v2/collaboration/teams/add-member-1.png) +![Add Members to Team](/img/v2/collaboration/teams/add-member-2.png) + + +## Remove Members from a Team + +In the **Teams** tab, select the team you want to manage, then follow these steps: + +1. Locate the member you want to remove. Use the search bar if needed and open the **Actions** (three dots) menu beside their name. +2. Select **Remove Member**. +3. Confirm the action when prompted. + +![Remove Member from Team](/img/v2/collaboration/teams/member-context-menu.png) +![Confirm Removal](/img/v2/collaboration/teams/remove-selected-2.png) + +To remove **multiple members** at once: + +1. Use the checkboxes to select the members you want to remove. +2. Click **Actions** > **Remove from Team** at the top of the member list. +3. Confirm the action when prompted. + +![Select Multiple Members](/img/v2/collaboration/teams/remove-multiple-1.png) +![Confirm Multiple Removal](/img/v2/collaboration/teams/remove-multiple-2.png) + +## Manage Team Owners + +A team can have multiple owners, but it must always have at least one. + +To add or remove team owners: + +1. In the **Teams** tab, select the team you want to manage. +2. Locate the member whose ownership status you want to change. Use the search bar if necessary and open the **Actions** (three dots) menu beside their name. +3. To grant ownership, select **Assign as Team Owner**. To revoke ownership, select **Remove as Team Owner**. + +![Manage Team Owner](/img/v2/collaboration/teams/team-owner-1.png) +![Manage Team Owner](/img/v2/collaboration/teams/team-owner-2.png) + + +## Leave Team + +Members can leave team on their own if they no longer wish to be part of it (any team member can leave, not just owners -- as long as at least one owner remains). + +To leave a team you are a member of: +1. In the **Teams** tab, open team context menu by clicking the **Actions** (three dots) button beside the team name. +2. Click the **Leave Team** button from the dropdown menu. +3. Confirm the action when prompted. + +![Leave Team](/img/v2/collaboration/teams/leave-team-1.png) +![Confirm Leave Team](/img/v2/collaboration/teams/leave-team-2.png) + +## Rename Team + +In the **Teams** tab, select the team you want to rename. Edit team name as needed, and your changes will be saved automatically. + +![Rename Team](/img/v2/collaboration/teams/rename-team.png) + + +## Delete Team + +Only Team Owners can delete a team. Deleting a team will not remove its members from the workspace; it only dissolves the team grouping. + +To delete a team: +1. In the **Teams** tab, open team context menu by clicking the **Actions** (three dots) button beside the team name. +2. Click the **Delete Team** button from the dropdown menu. +3. Confirm the action when prompted. + +![Delete Team](/img/v2/collaboration/teams/delete-team-1.png) +![Confirm Delete Team](/img/v2/collaboration/teams/delete-team-2.png) + +## Assign Roles to Teams + +You can assign roles to teams at both the workspace and base levels, similar to how you assign roles to individual users. When a team is granted a role, all its members inherit that role according to the effective role resolution rules detailed below. + +### Effective Role Resolution + +Effective permissions for a user at base level are determined by combining explicit (individual) assignments and team-derived assignments using the following precedence rules: + +1. Explicit individual role at Base (highest precedence) +2. Best (most permissive) role among Team roles assigned at Base +3. Explicit individual role at Workspace level other than "Inherit" +4. Best (most permissive) role among Team roles assigned at Workspace +5. No-access (default) + +**Notes** +- An explicit individual assignment always overrides any team-derived role at the same level. +- Lower-level roles (Base) override higher-level roles (Workspace) when an explicit assignment exists at the lower level. +- When multiple team roles apply, the system chooses the most permissive role (for example, between Viewer and Editor it will choose Editor). + +## Best Practices + +* **Invite all users** to the workspace with the **Inherit** role. This grants no direct permissions but allows users to be included in teams. Note that assigning a **No Access** role at the workspace level overrides and blocks all team-derived permissions. +* **Organize teams** based on your company’s structure — for example, by departments or project groups. +* **Assign roles to teams** at the workspace or base level according to access needs. +* **Use explicit individual roles** only for special cases or exceptions to maintain consistent access control. +* **Maintain clear naming conventions** for teams (e.g., `Eng - Backend`, `Ops - HR`) to simplify management and improve visibility across large workspaces. +* **Review team membership regularly** to ensure only active users retain access. Remove members who have left the organization or changed roles. +* **Assign multiple team owners** to avoid administrative bottlenecks in case one owner is unavailable. + + + +--- diff --git a/content/docs/collaboration/workspace-collaboration.mdx b/content/docs/collaboration/workspace-collaboration.mdx index a26fff4b..e7e97b21 100644 --- a/content/docs/collaboration/workspace-collaboration.mdx +++ b/content/docs/collaboration/workspace-collaboration.mdx @@ -1,47 +1,101 @@ --- title: 'Workspace collaboration' -description: 'This article explains how to invite members to your workspace, change their roles and procedure to remove them from the workspace.' -tags: ['Collaboration', 'Workspaces', 'Members', 'Invite', 'Roles'] -keywords: ['Invite members', 'Member roles', 'Access permissions', 'Displaying workspace members', 'Modifying member roles', 'Removing workspace members', 'Workspace collaboration', 'Workspace settings'] +description: 'This article explains how to invite members or teams to your workspace, manage their roles, and remove them when needed.' +tags: ['Collaboration', 'Workspaces', 'Members', 'Teams', 'Invite', 'Roles'] +keywords: ['Invite members', 'Invite teams', 'Member roles', 'Team roles', 'Access permissions', 'Displaying workspace members', 'Displaying workspace teams', 'Modifying roles', 'Removing members', 'Removing teams', 'Workspace collaboration', 'Workspace settings'] --- A comprehensive guide regarding roles and permissions can be accessed [here](/docs/product-docs/roles-and-permissions) -## Invite members to Workspace -1. Navigate to the Workspace configuration page by selecting `Team & Settings` in the left sidebar. -2. Access the `Members` tab. -3. Input the email address of the intended member for the invitation. -4. Click on `Role` dropdown menu -5. Choose the appropriate access permission for the member from the dropdown menu. -6. Conclude the process by selecting the `Add Member(s)` button. +Teams feature availability: **Business** plan onwards in cloud and On-premise **Enterprise** edition -Any user can invite members to the workspace, but they can only assign a role to new members that is at most equal to their own role +## Invite Members to Workspace +1. Go to **Team & Settings** in the left minibar. +2. Open the **Members** tab. +3. Click **Add Member**. +4. Enter one or more email addresses (comma-separated). +5. Select a role for the invited member(s). +6. Click **Invite to Workspace**. -![image](/img/v2/workspace/workspace-collaboration.png) +Any user can invite members to the workspace, but they can only assign a role to new members that is at most equal to their own role. -You have the capability to invite multiple members simultaneously by entering their email addresses, separated by commas +![image](/img/v2/workspace/workspace-collaboration-1.png) +![image](/img/v2/workspace/workspace-collaboration-2.png) +![image](/img/v2/workspace/workspace-collaboration-3.png) +You have the capability to invite multiple members simultaneously by entering their email addresses, separated by commas. -## List Workspace members -The `Members` tab displays a list of users who have been granted access to the workspace. -Members list is accessible to all workspace members +## Invite Teams to Workspace ☁ +NocoDB now allows inviting **Teams** to the workspace for simplified collaboration. Teams can be assigned workspace-level access roles, streamlining permissions for all their members. + +1. Navigate to the `Team & Settings` page and open the `Members` tab. +2. Click on the `Add Teams` button. +3. From the dropdown, select one or multiple teams to add. +4. Choose the appropriate access role from the dropdown menu. Note that, + - Similar to individual members, you can only assign roles that are at most equal to your own role in the workspace. + - Teams can't be assigned the **Owner** role. +5. Click on the `Add Teams` button to complete the process. + +When a team is invited to the workspace, all users under that team inherit the assigned workspace-level role unless overridden by a lower-level permission (explicit workspace role or base-level role). + +![image](/img/v2/workspace/teams/add-teams-1.png) +![image](/img/v2/workspace/teams/add-teams-2.png) + +To learn more about creating and managing teams, refer to the [Teams documentation](/docs/product-docs/collaboration/teams). + + +## List Workspace Members and Teams +The `Members` tab displays all users and teams that have access to the workspace. + +- Individual members appear with their email addresses. +- Teams are listed with their name and member count. + +Members and teams list is accessible to all workspace members. ![image](/img/v2/workspace/workspace-members-list.png) -## Modify Workspace Member Roles -You can modify the access permissions of members by following these steps: -1. Access the dropdown menu. -2. Select the desired new role option. -Updates to existing workspace member roles can only be made by the workspace **owner** or **creator** +## Modify Roles for Members or Teams +Access permissions for both members and teams can be updated directly from the `Members` tab. + +1. Click on the access dropdown next to the member or team. +2. Select a new role from the list of available options. + +You can only assign roles that are at most equal to your own role in the workspace. Teams cannot be assigned the **Owner** role. + +![image](/img/v2/workspace/teams/edit-team-role.png) + -![image](/img/v2/workspace/workspace-members-role-change.png) +## Role Precedence +When a user has multiple role assignments through both team and individual access, NocoDB resolves the final permission using a clear precedence order. -## Remove Workspace Members -To remove a member from the workspace, take the following steps: -1. Click on the vertical ellipses `⋮` to open the context menu. -2. Select the `Remove User` option. +- Individual explicit role takes precedence over team-assigned role. +- Base-level roles override workspace-level roles. +- In case of multiple team roles, the **highest** permission applies. + +This ensures users always retain the most permissive access assigned at their lowest configured level. + +To learn more about effective role resolution, refer to the [Teams effective role resolution documentation](/docs/product-docs/collaboration/teams#effective-role-resolution). + + +## Remove Members or Teams from Workspace +You can remove both members and teams from the workspace using the context menu. + +1. Click on the vertical ellipses `⋮` beside the member or team entry. +2. Select the appropriate removal option — `Remove User` or `Remove Team`. + +Only the workspace **owner** or **creator** can remove members or teams from the workspace. -Only the workspace **owner** or **creator** can remove members from the workspace ![image](/img/v2/workspace/workspace-members-remove.png) +![image](/img/v2/workspace/teams/remove-team.png) + + +## Best Practice +- Invite all users to the workspace first with the **Inherit** role. This will allow them to access workspaces based on their team or base-level roles. +- Use teams for departments or functional groups to manage roles efficiently. +- Adjust team-level permissions instead of managing roles individually for large workspaces. + +Learn more [here](/docs/product-docs/collaboration/teams#best-practices). + +--- diff --git a/content/docs/roles-and-permissions/field-permissions.mdx b/content/docs/roles-and-permissions/field-permissions.mdx index 422eabbe..408b51f8 100644 --- a/content/docs/roles-and-permissions/field-permissions.mdx +++ b/content/docs/roles-and-permissions/field-permissions.mdx @@ -5,7 +5,7 @@ tags: ['Field', 'Permissions'] keywords: ['Field permissions', 'NocoDB field permissions', 'NocoDB roles', 'NocoDB permissions', 'NocoDB field permissions overview'] --- -Field permissions are available in NocoDB cloud- Team plan onwards and Self hosted Enterprise plans +Available on NocoDB Cloud from the **Team** plan onwards, and in **Self-hosted Enterprise** editions. Field permissions in NocoDB allow you to control who can edit values in specific fields in a table. This feature is particularly useful for managing sensitive data or ensuring that only authorized users can modify certain information. @@ -27,27 +27,29 @@ You can assign different levels of access to each field. The available options a |--------------------|----------------------------------------------------------------------| | **Editors & up** | Members with **Editor**, **Creator**, or **Owner** roles *(default)* | | **Creators & up** | Members with **Creator** or **Owner** roles | -| **Specific users** | A custom list of selected members | +| **Specific users** | Selected members or teams | | **Nobody** | No one can edit this field | By default, users with **Editor** role and above can edit data in all fields in a table. * Select **Creators & up** to prevent editors from editing values in this field. * Select **Nobody** to disable editing values for all users in this field. -* Select **Specific users** to grant access only to selected members. -> Only members with **Editor**, **Creator**, or **Owner** roles are available for selection in the dropdown for specific user selection. +* Choose **Specific users** to allow only selected members or teams to edit this field. + +Only members and teams with **Editor**, **Creator**, or **Owner** roles can be selected for specific access configuration. ![Field permissions](/img/v2/permissions/field-permissions-3.png) - -Additional notes on field permissions: -- Field permissions do not affect the ability to view records in the table. Users with access can still view all records, but their ability to edit values in specific fields will be restricted based on the permissions set. -- Field permissions are applied at the field level, meaning they affect all records within that table for the specified field. Cannot be set for individual / selected records. -- Field permissions are independent of table permissions. You can set field permissions without enabling table permissions, and vice versa. -- Field permissions also restrict the ability to edit values via API calls and shared forms. -- Field permissions can be set for all field types except for the following field type, as these fields are calculated / system fields and cannot be edited directly. - - formula, rollup, lookup, created-by, last-updated-by, created-at, last-updated-at, button, qr-code, barcode -- For **LinkToAnotherRecord** field type, only the source table LTAR field permission will suffice to control the ability to edit the field (add / remove links). The related table LTAR field permissions will not be accounted for. For example: Country [has-many] City, if the user has permission to edit the Country table, they will be able to add / remove links to City table records in the Country table, even if they do not have permission to edit the City table related LTAR field. - +### **Additional Notes on Field Permissions** + +* Field permissions **do not control field visibility** — users with access can still view all field data, but their ability to edit values in specific fields depends on the configured permissions. +* Permissions are applied at the **field level**, affecting all records in the table for that specific field. They cannot be configured for individual or selected records. +* Field permissions operate **independently** of table permissions. You can configure field permissions without enabling table permissions, and vice versa. +* Field permissions also apply to **API calls** and **shared forms**, restricting the ability to modify field values through these interfaces. +* Field permissions can be set for all field types except the following, as these are **calculated or system fields** and cannot be edited directly: + * *Formula*, *Rollup*, *Lookup*, *Created By*, *Last Updated By*, *Created At*, *Last Updated At*, *Button*, *QR Code*, *Barcode* +* For **Link to Another Record (LTAR)** fields, only the source table’s LTAR field permission determines editability (add/remove links). The related table’s LTAR permissions are not considered. + * *Example:* If **Country** has many **Cities**, and a user has permission to edit the LTAR field in the **Country** table, they can add or remove links to **City** records from the **Country** table — even if they lack edit permission for the **City** table’s corresponding LTAR field. + ## Permissions Overview diff --git a/content/docs/roles-and-permissions/index.mdx b/content/docs/roles-and-permissions/index.mdx index ea0f744b..c704a989 100644 --- a/content/docs/roles-and-permissions/index.mdx +++ b/content/docs/roles-and-permissions/index.mdx @@ -6,51 +6,126 @@ keywords: ['Roles overview', 'Permissions overview', 'NocoDB roles', 'NocoDB per icon: "userCreator" --- +In NocoDB, roles define what users or teams can do within a **Workspace** or a **Base**. +They govern access control, ensuring that members and teams have appropriate privileges based on their responsibilities. -In NocoDB, we have roles that determine what people can do in a Workspace or Base. +Teams feature availability: **Business** plan onwards in cloud and On-premise **Enterprise** edition -You can give a member one of these roles: +You can assign the following roles: * Owner -* Creator +* Creator * Editor -* Commenter +* Commenter * Viewer * No Access - -If a role is assigned to a member at the base level, it takes precedence over a role assigned at the workspace level. - +& a special role "Inherit" discussed below. + +If a role is assigned at the base level, it takes precedence over the workspace-level role. Roles are hierarchical — higher roles include all permissions of the roles below them, allowing flexibility and clarity in managing access across your workspace and bases. Details about each role and their permissions are provided below. -When inviting a user, their role designation is initially assigned but can be modified later. Our role system -operates incrementally, with higher-level roles encompassing all privileges of lower-level roles. -This hierarchy offers flexibility in permissions and fosters a transparent organizational structure -in workspace or base management. ## Roles -Roles serve as the basis for user privileges in NocoDB. They are associated with members at two levels: -Workspace and Base. When a member is invited to a Workspace with a specific role, like an "Editor," they -automatically have that role in all Bases within that Workspace. However, base owners or creators can customize -permissions at the base level to align with specific needs. This dual-level role assignment system -ensures adaptable user permissions and access management in NocoDB. +Roles define access privileges in NocoDB and can be assigned at two levels — **Workspace** and **Base**. + +When a member or team is invited to a workspace with a specific role (for example, **Editor**), they automatically receive that level of access across all bases within the workspace, unless overridden at the base level. +Base owners or creators can further refine permissions at the base level to meet specific collaboration needs. + +This dual-level role structure provides granular control, balancing workspace-wide consistency with base-specific customization. + +Workspace-level roles do not automatically grant access to **Private Bases**. Members must be explicitly invited to a Private Base to gain access, regardless of their workspace role. Learn more about Priavte Bases in the [Private Bases documentation](/docs/product-docs/bases/private-base). + +The following sections detail each role and its associated permissions. + +### **Owner** +- Assigned automatically to the person who creates a workspace or base. +- Has full administrative privileges, including the ability to delete the workspace or base. +- Only **individual members** can be assigned the Owner role. **Teams** cannot be assigned this role. + +### **Creator** +- Has full control over the workspace or base except for deletion privileges, which are exclusive to the Owner. +- Can manage users, schema, automations, and all data operations. +- Suitable for administrators and key project leads. + +### **Editor** +- Can add, edit, and delete records within tables. +- Cannot modify the schema, such as adding or removing tables, fields, or relationships. +- Has access to toolbar features like **Filter**, **Sort**, and **Group By** for managing data views. +- Ideal for contributors responsible for day-to-day data management. + +### **Commenter** +- Can view records and leave comments on existing entries. +- Cannot edit, delete, or add records. +- **Toolbar access** (Filter, Sort, Group By) is not available. +- Best suited for reviewers or collaborators providing feedback. + +### **Viewer** +- Has read-only access to records and comments. +- Cannot make any data changes or leave comments. +- **Toolbar access** (Filter, Sort, Group By) is not available. +- Ideal for external stakeholders who need view-only access. + +### **No Access** +- Revokes access entirely to a workspace or base. +- When applied at the workspace level, the user or team cannot access any bases within it. +- When applied at the base level, it restricts access to that base only. + +### **Inherit** +"Inherit" is a special role that allows users to derive their permissions based on team assignments within a workspace. It functions as follows: + +- At the **workspace** level, allows users to derive their role from team assignments within the workspace. +- At the **base** level, adopts the role defined at the workspace level. +- Offers flexibility in managing roles across multiple bases within a workspace. +- Note: The Inherit role cannot be directly assigned at the workspace level. + +If a user is invited to a workspace with the **Inherit** role and then added to a team with the **Viewer** role, the user will have **Viewer** access across all bases within that workspace. +If the user is invited to the workspace with the **No Access** role and later added to a team with the **Editor** role, the user will still have **No Access** in all bases within that workspace. + +The **Inherit** role is the only explicit role that allows role derivation from team assignments. For all other roles, explicit workspace roles take precedence over corresponding team roles. + +At base level, if a user is assigned the **Inherit** role, their effective role will be determined by their workspace-level role or team-derived role, following the effective role resolution rules outlined below. -**Owner**: When a member creates a new Workspace or Base, they automatically become the Workspace or Base "Owner." -This role grants exclusive privileges, including the authority to delete the Workspace or Base. -**Creator**: The "Creator" role shares all privileges with an "Owner," except for deleting the workspace or base. -"Creators" have full administrative rights, except for deletion authority, which remains exclusive to the "Owner." -This ensures balanced workspace or base management. +## Effective Role Resolution -**Editor**: An "Editor" can create and edit records but cannot modify the base schema, -like adding tables or fields. They strike a balance between data input and schema management. +Effective permissions for a user at base level are determined by combining explicit (individual) assignments and team-derived assignments using the following precedence rules: -**Commenter**: The "Commenter" role cannot add or edit records but can provide comments on existing records -, facilitating communication and feedback. +1. Explicit individual role at Base (highest precedence) +2. Best (most permissive) role among Team roles assigned at Base +3. Explicit individual role at Workspace level other than "Inherit" +4. Best (most permissive) role among Team roles assigned at Workspace +5. No-access (default) -**Viewer**: "Viewers" can only access records and associated comments, without the ability to contribute -or make changes, ensuring controlled access for informational purposes. +**Notes** +- An explicit individual assignment always overrides any team-derived role at the same level. +- Lower-level roles (Base) override higher-level roles (Workspace) when an explicit assignment exists at the lower level. +- When multiple team roles apply, the system chooses the most permissive role (for example, between Viewer and Editor it will choose Editor). -**No Access**: This role, applied at the base level, revokes base access for the designated user. When applied at the workspace level, it gives the user no default access to any base within the workspace. +**Base hierarchy**: +`Individual Base role` > `Team Base role` > `Individual Workspace role` > `Team Workspace role` > `No Access` + +**Workspace hierarchy**: + +`Individual Workspace role` > `Team Workspace role` > `No Access` + +When a user belongs to multiple teams, their Team role is determined by the highest (most permissive) role among all their team assignments. + +## Roles for Teams +Teams function as a collective access unit for easier management. When a team is assigned a workspace or base role: +- All team members inherit that role automatically. +- Individual user roles can override team-assigned roles if explicitly set. +- A team can be invited at both workspace and base levels for broader or limited access. +- Teams **cannot** be assigned the **Owner** role. +- Teams **cannot** be assigned the **Inherit** role at the workspace level. + +If a team is invited at the workspace level, all its members receive that workspace role unless an individual or base-level role provides different access. + +Learn more about Teams & Collaboration here +- [Teams documentation](/docs/product-docs/collaboration/teams) +- [Workspace collaboration](/docs/product-docs/workspaces/workspace-collaboration) +- [Base collaboration](/docs/product-docs/bases/base-collaboration) + +--- ### Workspace level permissions The individual who creates the workspace is automatically designated as a Workspace owner. @@ -59,40 +134,52 @@ within the parent workspace. When a member becomes part of a workspace, the role automatically applied to them for all bases in that workspace, unless a specific exception is configured to override at base level. -| Task | Owner | Creator | Editor | Commenter | Viewer | -|-----------------------------------------|:-----:|:-------:|:------:|:---------:|:------:| -| Invite member to workspace | ✔️ | ✔️ | | | | -| Manage member access to workspace | ✔️ | ✔️ | | | | -| Remove member access from workspace | ✔️ | ✔️ | | | | -| View members in workspace | ✔️ | ✔️ | | | | -| Delete Workspace | ✔️ | ️ | | | | -| Billing & upgrade options | ✔️ | ️ | | | | -| Create a new base | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | -| Access existing bases at assigned roles | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | +| Task | Owner | Creator | Editor | Commenter | Viewer | +|-----------------------------------------------|:-----:|:-------:|:------:|:---------:|:------:| +| Invite member to workspace (***1**) | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | +| Manage member access to workspace (***2**) | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | +| Remove member access from workspace (***3**) | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | +| View members in workspace | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | +| Create a new base | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | +| Access existing bases at assigned roles | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | +| Delete Workspace | ✔️ | ️ | | | | +| Billing & upgrade options | ✔️ | ️ | | | | +(***1**) Members can invite others at or below their own role. + +(***2**) Members can manage access for others at or below their own role. + +(***3**) Members can remove others at or below their own role. ### Base level permissions #### Collaboration -| Task | Owner | Creator | Editor | Commenter | Viewer | -|----------------------------------------------|:-----:|:-------:|:------:|:---------:|:------:| -| Invite members to base at or below your role | ✔️ | ✔️ | | | | -| Manage members access to base | ✔️ | ✔️ | | | | -| Remove member access from a base | ✔️ | ✔️ | | | | -| View members in a base | ✔️ | ✔️ | | | | -| Share base | ✔️ | ✔️ | | | | -| Share view | ✔️ | ✔️ | | | | +| Task | Owner | Creator | Editor | Commenter | Viewer | +|------------------------------------------|:-----:|:-------:|:------:|:---------:|:------:| +| Invite member to base (***1**) | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | +| Manage member access to base (***2**) | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | +| Remove member access from base (***3**) | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | +| View members in a base | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | +| Share base | ✔️ | ✔️ | | | | +| Share view | ✔️ | ✔️ | | | | + +(***1**) Members can invite others at or below their own role. + +(***2**) Members can manage access for others at or below their own role. + +(***3**) Members can remove others at or below their own role. #### Table & view operations -| Task | Owner | Creator | Editor | Commenter | Viewer | -|---------------------------------|:-----:|:-------:|:------:|:---------:|:------:| -| Add / modify / delete table | ✔️ | ✔️ | | | | -| Add / modify / delete fields | ✔️ | ✔️ | | | | -| Add / modify / delete views | ✔️ | ✔️ | | | | -| Hide / un-hide / reorder fields | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | -| Add / modify / delete sort | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | -| Add / modify / delete filters | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | -| Add / modify / delete group-by | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | +| Task | Owner | Creator | Editor | Commenter | Viewer | +|----------------------------------|:-----:|:-------:|:------:|:---------:|:------:| +| Add / modify / delete table | ✔️ | ✔️ | | | | +| Add / modify / delete fields | ✔️ | ✔️ | | | | +| Add / modify / delete views | ✔️ | ✔️ | | | | +| Hide / un-hide / reorder fields | ✔️ | ✔️ | ✔️ | ️ | ️ | +| Add / modify / delete sort | ✔️ | ✔️ | ✔️ | ️ | ️ | +| Add / modify / delete filters | ✔️ | ✔️ | ✔️ | ️ | ️ | +| Add / modify / delete group-by | ✔️ | ✔️ | ✔️ | ️ | ️ | +| Add / modify / delete row colour | ✔️ | ✔️ | ✔️ | ️ | ️ | #### Record operations | Task | Owner | Creator | Editor | Commenter | Viewer | diff --git a/content/docs/roles-and-permissions/table-permissions.mdx b/content/docs/roles-and-permissions/table-permissions.mdx index 8c0d65b0..be5ab55f 100644 --- a/content/docs/roles-and-permissions/table-permissions.mdx +++ b/content/docs/roles-and-permissions/table-permissions.mdx @@ -5,17 +5,19 @@ tags: ['Table', 'Permissions'] keywords: ['Table permissions', 'NocoDB table permissions', 'NocoDB roles', 'NocoDB permissions', 'NocoDB table permissions overview'] --- -Table permissions in NocoDB let you control who can create or delete records in each table. This feature helps teams enforce stricter access control while still allowing collaborative workflows. +Table permissions in NocoDB allow you to control who can create or delete records in each table. This feature helps maintain data integrity while supporting flexible and collaborative workflows. -Table permissions are available in NocoDB cloud- Team plan onwards and Self hosted Enterprise plans +Available on NocoDB Cloud from the **Team** plan onwards, and in **Self-hosted Enterprise** editions. ## Enabling Table Permissions -To configure permissions on a specific table: + +To configure permissions for a specific table: + 1. Click the `⋯` icon next to the table name in the sidebar. 2. Select **Edit table permissions**. -3. Use the dropdowns to control who can: - - Create records - - Delete records +3. Use the dropdown menus to define who can: + * Create records + * Delete records ![Table permissions](/img/v2/permissions/table-permissions-1.png) @@ -23,52 +25,52 @@ To configure permissions on a specific table: ## Permission Levels -You can assign different levels of access to each action (create record / delete record). The available options are: +You can assign different access levels for each action (create or delete record). The available options are: + +| Option | Who gets access | +|-----------------------------|----------------------------------------------------------------------| +| **Editors & up** | Members with **Editor**, **Creator**, or **Owner** roles *(default)* | +| **Creators & up** | Members with **Creator** or **Owner** roles | +| **Specific users or teams** | Selected members or teams | +| **Nobody** | No one can perform this action | -| Option | Who gets access | -|--------------------|----------------------------------------------------------------------| -| **Editors & up** | Members with **Editor**, **Creator**, or **Owner** roles *(default)* | -| **Creators & up** | Members with **Creator** or **Owner** roles | -| **Specific users** | A custom list of selected members | -| **Nobody** | No one can perform this action | +By default, members with the **Editor** role and above can create and delete records in a table. -By default, users with **Editor** role and above can create and delete records in a table. -* Select **Creators & up** to prevent editors from performing these actions. -* Select **Nobody** to disable record creation or deletion for all users. -* Select **Specific users** to grant access only to selected members. +* Choose **Creators & up** to restrict these actions to creators and owners. +* Choose **Nobody** to disable record creation or deletion entirely. +* Choose **Specific users or teams** to grant access only to selected members or teams. -> Only members with **Editor**, **Creator**, or **Owner** roles are available for selection in the dropdown for specific user selection.* +Only members and teams with **Editor**, **Creator**, or **Owner** roles can be selected for specific access configuration. ![Table permissions](/img/v2/permissions/table-permissions-3.png) - -Additional notes on table permissions: -- Table permissions does not affect the ability to view records in the table. Users with access can still view all records, but their ability to create or delete records will be restricted based on the permissions set. -- Table permissions are applied at the table level, meaning they affect all records within that table. Cannot be set for individual / selected records. -- Table permissions are independent of field permissions. You can set table permissions without enabling field permissions, and vice versa. -- Table permissions also restrict the ability to - - create or delete records via API calls and - - create records using shared forms. - + +### Additional Notes on Table Permissions + +* Table permissions **do not control record visibility** — users with access can still view all records. However, their ability to create or delete records depends on the configured permissions. +* Permissions are applied at the **table level** and affect all records within that table. They cannot be defined for individual records or specific subsets. +* Table permissions function **independently** of field permissions; each can be configured separately. +* Table permissions also apply to: + * Record creation or deletion via **APIs**, and + * Record creation through **shared forms**. ## Permissions Overview -Permissions overview provides a quick summary of the current table & field permissions in a consolidated tabular view. +The permissions overview provides a consolidated summary of table and field permissions across the base. To access the permissions overview: -1. Go to base homepage (Click `Overview` in the sidebar). + +1. Go to the base homepage (click **Overview** in the sidebar). 2. Click the **Permissions** tab. ![Permissions overview](/img/v2/permissions/permissions-overview-1.png) -Subsequently, you can select the table for which you want to view the permissions overview. The overview will display field permissions in addition to table permissions, allowing you to see who can create or delete records in each table, as well as which fields are editable and by whom. +Select the table you want to review. The overview displays both table and field permissions, showing which members or teams can create or delete records and which fields are editable by whom. ![Permissions overview](/img/v2/permissions/permissions-overview-2.png) -`Permissions overview` can also be accessed from the table / field permission configuration modal. +You can also open the **Permissions overview** directly from the table or field permission configuration modal. ![Permissions overview](/img/v2/permissions/permissions-overview-3.png) - - - +--- diff --git a/content/docs/workspaces/workspace-collaboration.mdx b/content/docs/workspaces/workspace-collaboration.mdx index e4cd8042..d5afdc06 100644 --- a/content/docs/workspaces/workspace-collaboration.mdx +++ b/content/docs/workspaces/workspace-collaboration.mdx @@ -1,16 +1,15 @@ --- - title: 'Workspace collaboration' -description: 'Learn how to invite members to your workspace, assign roles, and manage member access.' -tags: ['Workspaces', 'Collaboration', 'Members', 'Invite', 'Roles', 'Permissions'] -keywords: ['Workspace configuration', 'Invite members', 'Member roles', 'Access permissions', 'Displaying workspace members', 'Modifying member roles', 'Removing workspace members', 'Workspace collaboration', 'Team collaboration', 'Access control', 'Role-based permissions', 'Workspace management', 'User roles', 'Workspace settings', 'Workspace administration', 'Member invitation', 'User access', 'Member management', 'Workspace teamwork', 'Workspace organization'] +description: 'This article explains how to invite members or teams to your workspace, manage their roles, and remove them when needed.' +tags: ['Collaboration', 'Workspaces', 'Members', 'Teams', 'Invite', 'Roles'] +keywords: ['Invite members', 'Invite teams', 'Member roles', 'Team roles', 'Access permissions', 'Displaying workspace members', 'Displaying workspace teams', 'Modifying roles', 'Removing members', 'Removing teams', 'Workspace collaboration', 'Workspace settings'] --- -Once your workspace is created, the next step is to collaborate by inviting team members. This guide walks through inviting members, managing roles, and removing users. -For a complete overview of roles and permissions, refer to the [Roles and Permissions guide](/docs/product-docs/roles-and-permissions). +A comprehensive guide regarding roles and permissions can be accessed [here](/docs/product-docs/roles-and-permissions) -## Invite members to workspace +Teams feature availability: **Business** plan onwards in cloud and On-premise **Enterprise** edition +## Invite Members to Workspace 1. Go to **Team & Settings** in the left minibar. 2. Open the **Members** tab. 3. Click **Add Member**. @@ -18,47 +17,85 @@ For a complete overview of roles and permissions, refer to the [Roles and Permis 5. Select a role for the invited member(s). 6. Click **Invite to Workspace**. -You can only assign roles equal to or below your own access level. +Any user can invite members to the workspace, but they can only assign a role to new members that is at most equal to their own role. ![image](/img/v2/workspace/workspace-collaboration-1.png) ![image](/img/v2/workspace/workspace-collaboration-2.png) ![image](/img/v2/workspace/workspace-collaboration-3.png) -To invite multiple members, separate email addresses with commas. +You have the capability to invite multiple members simultaneously by entering their email addresses, separated by commas. -## View workspace members -The **Members** tab displays everyone with access to the workspace. +## Invite Teams to Workspace ☁ +NocoDB now allows inviting **Teams** to the workspace for simplified collaboration. Teams can be assigned workspace-level access roles, streamlining permissions for all their members. -1. Navigate to **Team & Settings** in the left minibar. -2. Open the **Members** tab. +1. Navigate to the `Team & Settings` page and open the `Members` tab. +2. Click on the `Add Teams` button. +3. From the dropdown, select one or multiple teams to add. +4. Choose the appropriate access role from the dropdown menu. Note that, +- Similar to individual members, you can only assign roles that are at most equal to your own role in the workspace. +- Teams can't be assigned the **Owner** role. +5. Click on the `Add Teams` button to complete the process. + +When a team is invited to the workspace, all users under that team inherit the assigned workspace-level role unless overridden by a lower-level permission (explicit workspace role or base-level role). + +![image](/img/v2/workspace/teams/add-teams-1.png) +![image](/img/v2/workspace/teams/add-teams-2.png) + +To learn more about creating and managing teams, refer to the [Teams documentation](/docs/product-docs/collaboration/teams). -All workspace members can view the member list. + +## List Workspace Members and Teams +The `Members` tab displays all users and teams that have access to the workspace. + +- Individual members appear with their email addresses. +- Teams are listed with their name and member count. + +Members and teams list is accessible to all workspace members. ![image](/img/v2/workspace/workspace-members-list.png) -## Modify workspace member roles -1. Go to **Team & Settings** → **Members** tab. -2. Use the dropdown next to a member’s name to change their role. +## Modify Roles for Members or Teams +Access permissions for both members and teams can be updated directly from the `Members` tab. + +1. Click on the access dropdown next to the member or team. +2. Select a new role from the list of available options. -Only the workspace **owner** or **creator** can update member roles. +You can only assign roles that are at most equal to your own role in the workspace. Teams cannot be assigned the **Owner** role. -![image](/img/v2/workspace/workspace-members-role-change.png) +![image](/img/v2/workspace/teams/edit-team-role.png) -## Remove workspace members -1. Go to **Team & Settings** → **Members** tab. -2. Click the vertical ellipsis `⋮` next to a member’s name. -3. Select **Remove User**. +## Role Precedence +When a user has multiple role assignments through both team and individual access, NocoDB resolves the final permission using a clear precedence order. -Only the workspace **owner** or **creator** can remove members. +- Individual explicit role takes precedence over team-assigned role. +- Base-level roles override workspace-level roles. +- In case of multiple team roles, the **highest** permission applies. + +This ensures users always retain the most permissive access assigned at their lowest configured level. + +To learn more about effective role resolution, refer to the [Teams effective role resolution documentation](/docs/product-docs/collaboration/teams#effective-role-resolution). + + +## Remove Members or Teams from Workspace +You can remove both members and teams from the workspace using the context menu. + +1. Click on the vertical ellipses `⋮` beside the member or team entry. +2. Select the appropriate removal option — `Remove User` or `Remove Team`. + +Only the workspace **owner** or **creator** can remove members or teams from the workspace. ![image](/img/v2/workspace/workspace-members-remove.png) +![image](/img/v2/workspace/teams/remove-team.png) + -## Related articles +## Best Practice +- Invite all users to the workspace first with the **Inherit** role. This will allow them to access workspaces based on their team or base-level roles. +- Use teams for departments or functional groups to manage roles efficiently. +- Adjust team-level permissions instead of managing roles individually for large workspaces. -* [Workspace overview](/docs/product-docs/workspaces) -* [Create workspace](/docs/product-docs/workspaces/create-workspace) -* [Rename workspace](/docs/product-docs/workspaces/actions-on-workspace#rename-workspace) -* [Delete workspace](/docs/product-docs/workspaces/actions-on-workspace#delete-workspace) +Learn more [here](/docs/product-docs/collaboration/teams#best-practices). + +--- diff --git a/public/img/v2/collaboration/base/base-add-members-1.png b/public/img/v2/collaboration/base/base-add-members-1.png new file mode 100644 index 00000000..47cd0781 Binary files /dev/null and b/public/img/v2/collaboration/base/base-add-members-1.png differ diff --git a/public/img/v2/collaboration/base/base-add-members-2.png b/public/img/v2/collaboration/base/base-add-members-2.png new file mode 100644 index 00000000..e1b6ccda Binary files /dev/null and b/public/img/v2/collaboration/base/base-add-members-2.png differ diff --git a/public/img/v2/collaboration/base/base-add-teams-1.png b/public/img/v2/collaboration/base/base-add-teams-1.png new file mode 100644 index 00000000..22578306 Binary files /dev/null and b/public/img/v2/collaboration/base/base-add-teams-1.png differ diff --git a/public/img/v2/collaboration/base/base-add-teams-2.png b/public/img/v2/collaboration/base/base-add-teams-2.png new file mode 100644 index 00000000..3314b058 Binary files /dev/null and b/public/img/v2/collaboration/base/base-add-teams-2.png differ diff --git a/public/img/v2/collaboration/base/base-edit-roles.png b/public/img/v2/collaboration/base/base-edit-roles.png new file mode 100644 index 00000000..d638f5ff Binary files /dev/null and b/public/img/v2/collaboration/base/base-edit-roles.png differ diff --git a/public/img/v2/collaboration/base/base-members-list.png b/public/img/v2/collaboration/base/base-members-list.png new file mode 100644 index 00000000..bd9ba3f6 Binary files /dev/null and b/public/img/v2/collaboration/base/base-members-list.png differ diff --git a/public/img/v2/collaboration/teams/add-member-1.png b/public/img/v2/collaboration/teams/add-member-1.png new file mode 100644 index 00000000..13650038 Binary files /dev/null and b/public/img/v2/collaboration/teams/add-member-1.png differ diff --git a/public/img/v2/collaboration/teams/add-member-2.png b/public/img/v2/collaboration/teams/add-member-2.png new file mode 100644 index 00000000..60e2a7c9 Binary files /dev/null and b/public/img/v2/collaboration/teams/add-member-2.png differ diff --git a/public/img/v2/collaboration/teams/create-team-1.png b/public/img/v2/collaboration/teams/create-team-1.png new file mode 100644 index 00000000..932586be Binary files /dev/null and b/public/img/v2/collaboration/teams/create-team-1.png differ diff --git a/public/img/v2/collaboration/teams/create-team-2.png b/public/img/v2/collaboration/teams/create-team-2.png new file mode 100644 index 00000000..ada9344f Binary files /dev/null and b/public/img/v2/collaboration/teams/create-team-2.png differ diff --git a/public/img/v2/collaboration/teams/delete-team-1.png b/public/img/v2/collaboration/teams/delete-team-1.png new file mode 100644 index 00000000..3fb082ca Binary files /dev/null and b/public/img/v2/collaboration/teams/delete-team-1.png differ diff --git a/public/img/v2/collaboration/teams/delete-team-2.png b/public/img/v2/collaboration/teams/delete-team-2.png new file mode 100644 index 00000000..3b12d364 Binary files /dev/null and b/public/img/v2/collaboration/teams/delete-team-2.png differ diff --git a/public/img/v2/collaboration/teams/leave-team-1.png b/public/img/v2/collaboration/teams/leave-team-1.png new file mode 100644 index 00000000..a38d94ed Binary files /dev/null and b/public/img/v2/collaboration/teams/leave-team-1.png differ diff --git a/public/img/v2/collaboration/teams/leave-team-2.png b/public/img/v2/collaboration/teams/leave-team-2.png new file mode 100644 index 00000000..5f2580f9 Binary files /dev/null and b/public/img/v2/collaboration/teams/leave-team-2.png differ diff --git a/public/img/v2/collaboration/teams/list-team.png b/public/img/v2/collaboration/teams/list-team.png new file mode 100644 index 00000000..97b4e816 Binary files /dev/null and b/public/img/v2/collaboration/teams/list-team.png differ diff --git a/public/img/v2/collaboration/teams/member-context-menu.png b/public/img/v2/collaboration/teams/member-context-menu.png new file mode 100644 index 00000000..38b8e722 Binary files /dev/null and b/public/img/v2/collaboration/teams/member-context-menu.png differ diff --git a/public/img/v2/collaboration/teams/remove-multiple-1.png b/public/img/v2/collaboration/teams/remove-multiple-1.png new file mode 100644 index 00000000..c1186695 Binary files /dev/null and b/public/img/v2/collaboration/teams/remove-multiple-1.png differ diff --git a/public/img/v2/collaboration/teams/remove-multiple-2.png b/public/img/v2/collaboration/teams/remove-multiple-2.png new file mode 100644 index 00000000..d6ba3c19 Binary files /dev/null and b/public/img/v2/collaboration/teams/remove-multiple-2.png differ diff --git a/public/img/v2/collaboration/teams/remove-selected-2.png b/public/img/v2/collaboration/teams/remove-selected-2.png new file mode 100644 index 00000000..702cbaf4 Binary files /dev/null and b/public/img/v2/collaboration/teams/remove-selected-2.png differ diff --git a/public/img/v2/collaboration/teams/rename-team.png b/public/img/v2/collaboration/teams/rename-team.png new file mode 100644 index 00000000..f3d8dc3e Binary files /dev/null and b/public/img/v2/collaboration/teams/rename-team.png differ diff --git a/public/img/v2/collaboration/teams/team-context-menu.png b/public/img/v2/collaboration/teams/team-context-menu.png new file mode 100644 index 00000000..594acc34 Binary files /dev/null and b/public/img/v2/collaboration/teams/team-context-menu.png differ diff --git a/public/img/v2/collaboration/teams/team-owner-1.png b/public/img/v2/collaboration/teams/team-owner-1.png new file mode 100644 index 00000000..8538f815 Binary files /dev/null and b/public/img/v2/collaboration/teams/team-owner-1.png differ diff --git a/public/img/v2/collaboration/teams/team-owner-2.png b/public/img/v2/collaboration/teams/team-owner-2.png new file mode 100644 index 00000000..f3df5cc6 Binary files /dev/null and b/public/img/v2/collaboration/teams/team-owner-2.png differ diff --git a/public/img/v2/permissions/permissions-overview-3.png b/public/img/v2/permissions/permissions-overview-3.png index 799f3078..ba4afa76 100644 Binary files a/public/img/v2/permissions/permissions-overview-3.png and b/public/img/v2/permissions/permissions-overview-3.png differ diff --git a/public/img/v2/permissions/table-permissions-1.png b/public/img/v2/permissions/table-permissions-1.png index a4cc7ac4..7d9d00a8 100644 Binary files a/public/img/v2/permissions/table-permissions-1.png and b/public/img/v2/permissions/table-permissions-1.png differ diff --git a/public/img/v2/workspace/teams/add-teams-1.png b/public/img/v2/workspace/teams/add-teams-1.png new file mode 100644 index 00000000..4863931f Binary files /dev/null and b/public/img/v2/workspace/teams/add-teams-1.png differ diff --git a/public/img/v2/workspace/teams/add-teams-2.png b/public/img/v2/workspace/teams/add-teams-2.png new file mode 100644 index 00000000..c88e65f9 Binary files /dev/null and b/public/img/v2/workspace/teams/add-teams-2.png differ diff --git a/public/img/v2/workspace/teams/edit-team-role.png b/public/img/v2/workspace/teams/edit-team-role.png new file mode 100644 index 00000000..36221968 Binary files /dev/null and b/public/img/v2/workspace/teams/edit-team-role.png differ diff --git a/public/img/v2/workspace/teams/remove-team.png b/public/img/v2/workspace/teams/remove-team.png new file mode 100644 index 00000000..badf4466 Binary files /dev/null and b/public/img/v2/workspace/teams/remove-team.png differ diff --git a/public/img/v2/workspace/workspace-collaboration-3.png b/public/img/v2/workspace/workspace-collaboration-3.png index d39b12ab..4a96a4e1 100644 Binary files a/public/img/v2/workspace/workspace-collaboration-3.png and b/public/img/v2/workspace/workspace-collaboration-3.png differ diff --git a/public/img/v2/workspace/workspace-collaboration.png b/public/img/v2/workspace/workspace-collaboration.png deleted file mode 100644 index a232d975..00000000 Binary files a/public/img/v2/workspace/workspace-collaboration.png and /dev/null differ diff --git a/public/img/v2/workspace/workspace-members-list.png b/public/img/v2/workspace/workspace-members-list.png index 518c33fb..ac6eab02 100644 Binary files a/public/img/v2/workspace/workspace-members-list.png and b/public/img/v2/workspace/workspace-members-list.png differ diff --git a/public/img/v2/workspace/workspace-members-remove.png b/public/img/v2/workspace/workspace-members-remove.png index 21a47a30..b1ef249c 100644 Binary files a/public/img/v2/workspace/workspace-members-remove.png and b/public/img/v2/workspace/workspace-members-remove.png differ