User roles and permissions

A plain-English guide to the three workspace roles in Ken AI, what each can do, and how to manage your team.

8 min read · Updated Jun 29, 2026

Overview

Every workspace in Ken AI has three roles - Admin, Editor, and Member. Your role controls which settings tabs you can see, which actions you can take, and what you can change for other people. The Users page is where Admins manage the team: invite new people, change roles, and remove members.

To reach it: open the sidebar, go to Settings, then click the Users tab.

Before you start

You must be an Admin to invite users, change roles, or remove members. Editors and Members can view the users list but the invite button and row actions are hidden from them.

If you are not an Admin and need to add a teammate, ask your workspace Admin to do it.

How to manage your team

View the team roster

Open Settings and click Users. The table shows every workspace member with four columns:

Name - avatar, display name, and a link-out icon
Email - copyable email address
LinkedIn Profile - copyable profile URL, if the member has added one
Role - a badge showing Admin, Editor, or Member

Use the Search field at the top-left to filter by name or email. The Total badge next to it shows the current member count.

Ken AI staff (getken.ai email addresses) are not shown in this list. They have access to assist you but appear only in internal tooling.

Invite a new member

Open Settings > Users.
Click Invite Member in the top-right corner.
In the Invite User dialog, enter the person's Email Address.
Select a Role from the dropdown (Member is the default).
Click Send Invitation.

The invited person receives an email. When they accept and sign in, they appear in the users list.

Change a member's role

In the Users table, find the row you want to edit.
Click the pencil icon on the right side of that row.
The Edit Role dialog opens with a role selector. The current role description is shown below the dropdown.
Select the new role.
Click Save Changes.

Self-demotion is blocked at the UI level: if you are an Admin editing your own row, the role selector is disabled. To change your own role, ask another Admin to do it from their account.

Remove a member

In the Users table, find the row you want to remove.
Click the trash icon on the right side of that row.
Confirm with Yes, remove in the dialog.

You cannot remove your own account. If you need to leave a workspace, ask another Admin to remove you.

The three roles in detail

| Role | Label shown in the app | What they can do | |---|---|---| | Admin | Admin | Full control: manage members and roles, edit company settings, create and manage campaigns and tags. | | Editor | Editor | Create and edit campaigns and tags. Cannot manage members, change roles, or access company settings. | | Member | Member | View dashboards, campaigns, and analytics. Reply in the inbox. No writes to campaigns, tags, or settings. |

Settings tab visibility by role:

| Tab | Admin | Editor | Member | |---|---|---|---| | Profile | Yes | Yes | Yes | | Company | Yes | No | No | | Users | Yes (full control) | Yes (read-only) | Yes (read-only) | | Security | Yes | Yes | Yes | | Integrations | Yes | Yes | Yes | | Tags | Yes | Yes | No | | Blocklist | Yes | Yes | No | | Billing | Yes | No | No |

Members and Editors can see the Users tab, but the Invite Member button and the edit/remove row actions are hidden. Navigation visibility is a convenience - actual enforcement happens on the server, not the UI.

How it works

Ken AI uses a three-role model backed by your identity provider. When you sign in and join a workspace, your role is stored per-workspace - you can have different roles in different workspaces.

Role resolution happens server-side. Every sensitive action - inviting a user, changing a role, editing company settings - re-checks your role on the server before making any change. If a check fails, you receive a clear "You do not have permission to..." message. The UI hiding a button or tab is a navigation shortcut, not the access gate.

The settings navigation determines which tabs are visible based on your role. When your role is unknown or cannot be confirmed (for example, a temporary lookup failure), the system shows tabs rather than hiding them, and the server remains the authoritative gate. This means you may sometimes see a tab you cannot use - navigating to it will show the correct restricted state without granting access.

When you invite someone, a Clerk organization invitation is sent to their email. The role you select is included with the invitation and takes effect immediately when they accept and join.

Role changes take effect right away. The next page load or action the affected user takes will use their new role.

Troubleshooting & debugging

Symptom: "Invite Member" button is missing.

Likely cause: you are not an Admin in the active workspace.
What to check: look at your own row in the Users table and confirm your Role badge shows Admin. If it shows Editor or Member, you need an Admin to send the invitation.

Symptom: "Invite User" dialog shows "This workspace is not linked to a Clerk organization yet."

Likely cause: the workspace was created before the organization link was established, or the link was lost.
What to check: close and reopen the dialog - the system tries to refresh the workspace link automatically when the dialog opens. If the message persists, ask a Ken AI team member to re-link the workspace from the backend.

Symptom: Invitation was sent but the user never appeared in the list.

Likely cause: the invitation email was not accepted yet, or landed in spam.
What to check: ask the invited person to check their inbox and spam folder for an invite from Ken AI. The user only appears in the Users list after they accept and sign in for the first time.

Symptom: Clicking the pencil icon opens "Edit Role" but the dropdown is disabled.

Likely cause: you are editing your own row as an Admin. Admins cannot demote themselves.
What to check: ask another Admin in the workspace to change your role.

Symptom: Role change saved successfully but the affected user still sees the old permissions.

Likely cause: the user's session is using a cached role.
What to check: ask the affected user to sign out and sign back in, or reload the page. Role changes are applied immediately server-side but the browser session carries the previous role until it refreshes.

Symptom: "You do not have permission to..." error on invite, role change, or remove.

Likely cause: your role does not have permission for that action, or you are not signed in to the correct workspace.
What to check: confirm the active workspace in the top-left workspace switcher. Confirm your own Role badge in the Users table. If you should be an Admin, ask another Admin to correct your role.

Symptom: Settings > Company tab is missing from the sidebar.

Likely cause: your role is Editor or Member.
What to check: the Company tab is Admin-only. If you need to edit company settings, ask your Admin or request a role upgrade.

Symptom: Settings > Billing tab is missing from the sidebar.

Likely cause: your role is Editor or Member.
What to check: the Billing tab is Admin-only. Contact your workspace Admin for billing changes.

FAQ

Can one person be an Admin in one workspace and a Member in another? Yes. Roles are per-workspace. Each workspace you belong to has its own role for you, independent of any other workspace.

Can an Admin accidentally lock themselves out by changing their own role? No. The UI blocks self-demotion - the role dropdown is disabled when you are editing your own Admin row. To change your own role, another Admin must do it from their account.

What happens if the last Admin leaves or is removed? The system blocks removing your own account, so an Admin cannot remove themselves. If you are the last Admin and need to transfer ownership, first upgrade another member to Admin, then ask them to remove you.

Does an invited user's role take effect before they accept? No. The user appears in the list and has their assigned role only after they accept the invitation and sign in for the first time.

Can Editors or Members see who else is in the workspace? Yes. The Users tab is visible to all roles. Editors and Members can read the full roster - name, email, LinkedIn, and role - but cannot invite, change roles, or remove anyone.

Can I change a user's role and invite permissions at the same time? No. Invitations carry a role at the time of sending. Once a user has joined, use the Edit Role dialog (pencil icon) to change their role independently.