Roles
Every tenant has four roles: owner, admin, member and viewer. Each member of a tenant has exactly one of them. FlowState fixes the permissions of each role; you cannot change them for your tenant, and FlowState does not offer custom roles.
In short:
- Owner: everything, including deleting the tenant and transferring ownership. A tenant has exactly one owner.
- Admin: everything except deleting the tenant and transferring ownership.
- Member: works with deals, analyses, goals and APN sync, and can use MCP. Cannot change settings, members, integrations or billing.
- Viewer: reads deals, analyses, goals and integration status. Cannot change anything and cannot use MCP.
Owners and admins get their permissions only after they set up multi-factor authentication: an authenticator app on their FlowState account, or a sign-in with a Google Workspace account.
Role matrix
| Permission | owner | admin | member | viewer |
|---|---|---|---|---|
tenant:settings:read | ✓ | ✓ | ✓ | ✓ |
tenant:settings:write | ✓ | ✓ | ||
tenant:members:read | ✓ | ✓ | ✓ | ✓ |
tenant:members:invite | ✓ | ✓ | ||
tenant:members:remove | ✓ | ✓ | ||
tenant:members:role:write | ✓ | ✓ | ||
tenant:grants:read | ✓ | ✓ | ||
tenant:grants:write | ✓ | ✓ | ||
tenant:keys:read | ✓ | ✓ | ||
tenant:keys:read:self | ✓ | ✓ | ✓ | |
tenant:keys:write | ✓ | ✓ | ✓ | |
tenant:billing:read | ✓ | ✓ | ||
tenant:billing:write | ✓ | ✓ | ||
tenant:transfer:owner | ✓ | |||
tenant:delete | ✓ | |||
tenant:features:read | ✓ | ✓ | ||
tenant:features:write | ✓ | ✓ | ||
tenant:integrations:hubspot:connect | ✓ | ✓ | ||
tenant:integrations:hubspot:disconnect | ✓ | ✓ | ||
tenant:integrations:hubspot:read | ✓ | ✓ | ✓ | ✓ |
tenant:integrations:slack:read | ✓ | ✓ | ✓ | ✓ |
tenant:integrations:slack:write | ✓ | ✓ | ||
tenant:integrations:apn:configure | ✓ | ✓ | ||
tenant:integrations:apn:read | ✓ | ✓ | ✓ | ✓ |
tenant:hubspot:read | ✓ | ✓ | ✓ | |
tenant:deals:analyze | ✓ | ✓ | ✓ | |
tenant:deals:read | ✓ | ✓ | ✓ | ✓ |
tenant:deals:reanalyze | ✓ | ✓ | ✓ | |
tenant:goals:read | ✓ | ✓ | ✓ | ✓ |
tenant:goals:write | ✓ | ✓ | ✓ | |
tenant:win-loss:read | ✓ | ✓ | ✓ | ✓ |
tenant:win-loss:trigger | ✓ | ✓ | ||
tenant:slack:test | ✓ | ✓ | ||
tenant:apn:read | ✓ | ✓ | ✓ | ✓ |
tenant:apn:sync:trigger | ✓ | ✓ | ✓ | |
tenant:marketplace:offers:read | ✓ | ✓ | ✓ | |
tenant:marketplace:offers:write | ✓ | ✓ | ||
tenant:marketplace:offers:release | ✓ | ✓ | ||
tenant:mcp:invoke | ✓ | ✓ | ✓ | |
tenant:notifications:read | ✓ | ✓ | ||
tenant:notifications:read:self | ✓ | ✓ | ✓ | ✓ |
tenant:notifications:write:self | ✓ | ✓ | ✓ | |
tenant:notifications:audit:read | ✓ | ✓ |
Permissions explains what each permission allows.
Who can assign each role
| Role | Who can assign it |
|---|---|
viewer | admin, owner |
member | admin, owner |
admin | admin, owner |
owner | Nobody. The current owner transfers ownership (see below). |
Invite a teammate
You need the owner or admin role.
- Go to Settings → Members.
- Under Invite member, enter the Email address, choose a Role (admin, member or viewer), and click Invite.
- The person appears under Pending invites. There you can resend the invite email or revoke the invite.
Revoking an invite removes only the invite. The person’s FlowState account stays, and so does their access to other tenants. You can invite the same email address again later.
If the person’s account was deleted, inviting their email address again restores the account. The restored account has no access from before the deletion. It has only the role in your invite. The person joins your tenant when they accept the invite, as usual.
What the invited person does:
- New to FlowState: they get an email with a temporary password and a Sign in to FlowState button. They click it, choose Sign in with email, sign in with the temporary password, set their own password, and join the tenant with the invited role.
- Already has a FlowState account: they get an email with an Accept invite button that opens FlowState. They join the tenant the first time they switch to it in the FlowState app.
An invite never creates an owner, and you can only invite someone with a role whose permissions
you hold yourself. Otherwise the invite is refused with 403 ROLE_NOT_ASSIGNABLE.
To invite many people at once, see Importing users.
Change a role or remove a member
On Settings → Members, under Team members, choose a new role for the member, or click the remove button and confirm. The owner’s role cannot be changed there, and the owner cannot be removed: transfer ownership first.
Transfer ownership
Only the owner can transfer ownership, to another member of the tenant. The transfer happens in one step: the new owner gets the owner role and the previous owner becomes an admin. There is never a moment without an owner.
The owner cannot delete their own FlowState account while they own a tenant that is not purged yet. This includes a tenant that is suspended, waiting for payment or deleted.
Delete the tenant
Only the owner can delete the tenant.