> ## Documentation Index > Fetch the complete documentation index at: https://trygradient.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Members and permissions > The four workspace roles, what each one can do, and how roles are assigned # Members and permissions Everyone who signs in to Gradient is a **member** of one organization. Each member holds one of four roles: **owner**, **admin**, **member**, or **reviewer**. The role decides what that person can do in the workspace. A **workspace role** is not the same thing as a [role](/docs/concepts/roles), which is a job opening you are hiring for. This page is about permissions. Manage members at **Settings, Team**. ## The four workspace roles: Owner, admin, member, and reviewer Commercial and existential control: billing, single sign-on, data retention, and who holds the owner and admin seats. The person who creates the organization is the first owner. How the workspace is set up: the org profile and branding, API keys, ATS integrations, inviting members and reviewers, and permanent deletion. The everyday recruiting role. Members build assessments, invite candidates, score, and release feedback. This is the role most of your team should hold. Read-only. Reviewers open a candidate report and read all of it, including the transcript and the scores, and export what they read. They change nothing. The hierarchy is **owner > admin > member > reviewer**. Each role includes everything the role below it can do. Give people **member** unless they need to configure the workspace. A member can run a hiring process from end to end and change nothing about the company. ## Permissions by role ### Reading | Action | Owner | Admin | Member | Reviewer | | ----------------------------------------------------- | :---: | :---: | :----: | :------: | | Sign in and browse roles, assessments, and candidates | Yes | Yes | Yes | Yes | | Read a transcript, the evidence, and the scores | Yes | Yes | Yes | Yes | | Read a feedback report before it is released | Yes | Yes | Yes | Yes | | Export or download anything above | Yes | Yes | Yes | Yes | | Read the member list and the org profile | Yes | Yes | Yes | Yes | | Read API key and integration credentials | Yes | Yes | No | No | | Read billing, invoices, and the payment method | Yes | No | No | No | ### Running your hiring | Action | Owner | Admin | Member | Reviewer | | ------------------------------------------------ | :---: | :---: | :----: | :------: | | Create and edit job roles and assessments | Yes | Yes | Yes | No | | Edit the data room | Yes | Yes | Yes | No | | Invite candidates, remind, and dismiss | Yes | Yes | Yes | No | | Change a score, calibrate, and release feedback | Yes | Yes | Yes | No | | Reopen a finished session | Yes | Yes | Yes | No | | Remove a candidate or assessment, and restore it | Yes | Yes | Yes | No | ### Setting up the workspace | Action | Owner | Admin | Member | Reviewer | | --------------------------------------------------- | :---: | :---: | :----: | :------: | | Edit the org name, description, and branding | Yes | Yes | No | No | | Create and revoke API keys | Yes | Yes | No | No | | Configure ATS integrations | Yes | Yes | No | No | | Invite, re-role, or remove a **member or reviewer** | Yes | Yes | No | No | | Delete a candidate or assessment permanently | Yes | Yes | No | No | ### Owner only | Action | Owner | Admin | Member | Reviewer | | ------------------------------------------------------------------ | :---: | :---: | :----: | :------: | | Manage billing and the payment method | Yes | No | No | No | | Configure SSO, SCIM, and MFA | Yes | No | No | No | | Configure auto-join by email domain | Yes | No | No | No | | Set the data retention policy | Yes | No | No | No | | Invite, re-role, or remove an **admin or owner** | Yes | No | No | No | | Read the [audit log](/docs/guides/audit-log) at **Settings, Audit log** | Yes | No | No | No | Everyone edits their own profile, whatever their role. ### Deleting work: Remove, delete permanently, and reopen Three actions delete work, and they do not carry the same risk. * **Remove** puts a candidate or an assessment in the trash. You can restore it. Members and above can do this. * **Delete permanently** erases the record and all of its files. You cannot restore it. Admins and above only. * **Reopen a session** discards the work in that phase and every phase after it, and replaces a score a reviewer may have read already. Members and above. Reviewers cannot delete or reopen anything. ## Default role settings There are four ways a person joins your organization, and each one sets the role differently. | How they joined | Role they get | | ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | | An owner or admin invited them | The role chosen in the invite. The default is reviewer, so pick **member** for anyone who will do the recruiting work. | | They created the organization | Owner. Only the first member of an empty organization gets this. | | They joined by email domain (auto-join) | Reviewer. | | They signed in through your identity provider (SSO or SCIM) | The role mapped from their directory group. See [Role sources](#role-sources-direct-saml-group-scim-group-and-heuristic). | Auto-join gives a new person access to every candidate report in the workspace as soon as they sign in with a matching email address. Turn it on only for domains you control, and review the member list after you enable it. ## Inviting a member You must be an owner or an admin. Enter the work email address and choose the role. Only an owner can choose **Owner** or **Admin**. Gradient emails a sign-in link. Clear **Send email** if you want to create the member record now and tell them yourself later. Use **Resend** on the member row if the link expires. An invited person keeps the role from the invitation when they first sign in. ## Changing a role or removing a member Open **Settings, Team**, then use the role menu on the member's row, or **Remove**. Three rules protect the workspace: * Only an owner can invite, promote, demote, or remove an **owner or an admin**. An admin staffs the tiers below it, not its own. * Admins can invite, re-role, and remove **members and reviewers**. * The **last owner** cannot be demoted or removed. Promote a second owner first. Removing a member ends their access at once. Their name stays on the work they did, such as a score they changed, so your history stays readable. ## Role sources: Direct, SAML group, SCIM group, and heuristic Gradient records the source of every member's role, because it is the first question an identity team asks. | Source | Meaning | | ---------- | ---------------------------------------------------------------------------------------------------------------------- | | Direct | An owner or an admin set the role in Gradient. | | SAML group | The role came from a group on the SAML assertion your identity provider sends. | | SCIM group | The role came from a group your identity provider pushes over SCIM. | | Heuristic | Gradient set the role at first sign-in: owner for the person who created the organization, reviewer for everyone else. | If your organization uses **SSO with group mapping** or **SCIM**, your identity provider is the source of truth. Gradient mirrors what it sends and never overrides it: * A group change in your identity provider reaches Gradient within about five minutes. A new sign-in is always current. * For SCIM-managed organizations, the invite and remove controls on **Settings, Team** are hidden. Add and remove people in your directory instead. To map a directory group to a role, use the role names exactly: `owner`, `admin`, `member`, or `reviewer`. ## Candidate access A candidate never signs in and never holds a role. Their assessment link is its own credential. Candidates cannot see the dashboard, other candidates, or their own score unless you release feedback to them. See [Authentication](/docs/guides/authentication) for how candidate links work.