Manage who can access a Mopheus workspace, what they can do, and how to invite, promote, or remove them.

Members & Roles

Every Mopheus workspace has its own member list. A user can belong to many workspaces, but their role is scoped per workspace — being an Owner in one workspace gives them no privileges in another.

Built-in Roles

Role	Can do
Owner	Everything below, plus delete the workspace and transfer ownership. Each workspace has at least one Owner.
Admin	Invite, remove, and promote members; edit workspace settings; manage agents, runtimes, skills, jobs, and tickets across the workspace.
Member	Create and edit tickets, projects, chats, skills, and personal agents. Archive, restore, and manage access to personal agents. Delete own chats and skills. Manage own runtimes. Cannot manage members or workspace settings.
Observer	Read-only access plus create and comment on tickets. Cannot execute agents, chat with agents, manage skills, or bind Lark accounts. Intended for stakeholders who need visibility without triggering automated workflows.

Agent Roles

Agents can also be assigned roles that control which API scopes they are permitted to call when acting on behalf of a ticket or job.

Role	Permitted scopes
agent:readonly	Read-only access. Cannot create, update, or delete any resource.
agent:normal	Create and update tickets, comments, agents, teams, jobs, files, and skills. Can manage team members (add, remove, promote). Cannot delete agents, teams, or jobs.
agent:admin	Full workspace write access — create, update, and delete tickets, comments, agents, teams, jobs, files, and skills. Can manage team members and delete teams.

Owners and Admins can create custom roles with any combination of the available permission scopes. Custom roles supplement the built-in roles — they can be assigned to members and agents in addition to the built-in roles.

Permission Scopes

Scope	Grants
`tickets:write`	Create and update tickets
`tickets:delete`	Delete tickets
`comments:write`	Create and update comments
`comments:delete`	Delete comments
`agents:write`	Create and update agents
`agents:manage`	Archive/restore agents and manage their resource access (assigning agent roles requires `workspace:manage-roles`)
`agents:execute`	Execute agents — trigger tasks, chat with agents, run jobs. Without this scope, agents and teams are hidden from pickers and mentions.
`agents:task-manage`	Cancel and retry agent tasks
`teams:write`	Create and update teams
`teams:manage`	Manage team membership and roles
`projects:write`	Create and update projects
`projects:delete`	Delete projects
`jobs:write`	Create and update jobs
`jobs:delete`	Delete jobs
`files:write`	Upload files
`files:delete`	Delete files
`workspace:invite`	Invite new members
`workspace:manage-members`	Change member roles and remove members
`workspace:manage-roles`	Create, update, and delete custom roles
`workspace:manage`	Edit workspace settings
`workspace:delete`	Delete the workspace
`chat-sessions:write`	Create and update chat sessions
`chat-sessions:delete`	Delete chat sessions
`skills:write`	Create and update skills
`skills:delete`	Delete skills
`runtimes:manage`	Manage agent runtimes
`repos:write`	Register, update, and sync git repositories and PR/Issue entities (requires the `git` feature)
`repos:delete`	Delete registered git repositories (requires the `git` feature)
`memory:write`	Distill memories from tickets, and store/update memories (requires the `memory` feature)
`memory:delete`	Delete memories (requires the `memory` feature)
`lark:bind`	Bind Lark (Feishu) accounts to agents. Owner/Admin can bind any agent; Members can only bind agents they own.
`lark:delete`	Unbind own Lark account. Owner/Admin can also revoke and delete any Lark installation.

Read access to all resources is implicit for any authenticated workspace actor. Scopes only control write and management operations.

Private agents are the exception to broad agent management scopes. Their names remain visible in references, but sensitive configuration is hidden from non-owners. agents:write and agents:manage do not allow a non-owner to modify, archive, or restore a private agent.

Manage Custom Roles

Open Settings → Roles
Click New Role
Enter a name and optional description
Toggle the scopes this role should grant
Click Save

To assign a custom role to a member or agent, go to Settings → Members and open the role editor for that actor. Multiple roles can be assigned; the effective permission set is the union of all assigned roles.

Invite a Member

Open Settings → Members
Click Invite
Enter the invitee's email address (multiple emails separated by comma, space, or semicolon; up to 200 per submission)
Click Send invite

Emails that already belong to a workspace member are skipped automatically — the result toast reports how many were invited vs. skipped.

The invitee receives a link of the form /invitations/<token>. Once they accept, they appear in the members list.

Pending invitations remain visible in the Members panel and can be revoked before they are accepted. You can also copy the invitation link or resend the invitation from the pending list.

Accepting an Invitation

When the invitee opens the invitation link, the system determines the appropriate acceptance flow based on server configuration:

Scenario	Condition	Flow
Already logged in	User has an active session	Click Accept to join the workspace directly. The system verifies that the logged-in user's email matches the invitation email — if not, the request is rejected.
Email configured	Server has SMTP / email service	Click Send Code → receive a 6-digit code via email → enter code → auto-login and join.
No email, registration open	No email service, `allowRegistration=true`	Enter a password to either log in (if the account already exists) or register a new account and join.
No email, registration closed	No email service, `allowRegistration=false`	Cannot accept the invitation. Contact the workspace admin.

The system automatically detects whether the invited email is already registered and adjusts the UI accordingly — showing a login prompt for existing users or a registration form for new users.

Change a Member's Role

Owners and Admins with the workspace:manage-members scope can change a member's roles:

Open Settings → Members
Find the row for the member you want to change
Use the Roles Picker to toggle custom roles on or off — changes apply immediately

Multiple roles can be assigned to a single member. The effective permission set is the union of all assigned roles. The Owner role cannot be changed through the picker — use Transfer Ownership instead.

Remove a Member

Open Settings → Members
Click the trash icon on the member's row
Confirm

The member loses access immediately. Tickets they were assigned remain on the ticket; the assignee becomes empty and you can re-assign them. Comments they wrote stay attached with their original author.

Only users with the workspace:manage-members scope can remove members. Owners cannot be removed.

Leave a Workspace

Any non-Owner member can leave a workspace:

Open Settings
Scroll to the Danger Zone section
Click Leave
Confirm

Owners must first transfer ownership (click the crown icon on another member's row) before they can leave. A workspace cannot be left without an Owner.

Command-line Reference

# List members in the active workspace
mopheus workspace member list

# Remove a member
mopheus workspace member remove <member-id>

# List pending invitations
mopheus workspace invite list

# Send an invitation
mopheus workspace invite create --email user@example.com

# Cancel an invitation
mopheus workspace invite delete <invitation-id>