Skip to content

Members and roles

Invite people to a SpecsGraph workspace, give each one the Owner, Admin, Editor or Viewer role, and see how agent tokens follow each member's role.

Invite people

Members belong to the workspace, not to a single project. Only Admins and Owners can invite and remove them.

  1. Open the member list

    Go to Workspace settings, then Members. The list shows every member, their role and any pending invitations.

  2. Invite by email

    Enter one or more email addresses and pick the role each person starts with. You can change it later.

  3. The person accepts

    They follow the link in the invitation and sign in with GitHub. Until they do, the invitation shows as pending, and you can revoke it.

How people sign in

Everyone signs in to SpecsGraph with a GitHub account. Your personal settings, including the personal access tokens your agents use, are under Account settings.

Invitations on a self-hosted install

A self-hosted install sends invitation emails only when SMTP_URL is set. Without it, choose Copy invite link next to the pending invitation and send the link yourself. People sign in with the OAuth credentials of your own GitHub App, set by GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET. See Configuration and Create your GitHub App.

Roles

A member has one role, and it applies in every project in the workspace. Each role includes everything the role below it can do.

RoleWhat they can do
OwnerEverything an Admin can do, plus workspace export and import, and deleting the workspace.
AdminInvite and remove members, connect GitHub, manage projects and set token policy.
EditorOpen, edit and approve proposals, manage workstreams and record decisions.
ViewerRead everything and join review threads with comments.

Give Editor to anyone who should be able to approve a proposal, including product managers and designers who own the wording of requirements. Give Viewer to people who read the spec and ask questions in review threads but do not sign off on changes.

Change a role

Admins and Owners change roles from the member list. The change applies right away, including to every access token the member owns. A workspace always keeps at least one Owner: to hand the workspace over, make the new person Owner before you change your own role.

Seats

The self-hosted edition is free and does not count seats, so invite everyone who should read or shape the spec. On SpecsGraph Cloud, which is coming soon, every member will count as a seat, Viewers included, but agents never will; see Cloud plans.

Agents act with their owner's role

An agent connects with a personal access token that a member creates. The token carries its owner's role and never more, so what the agent can do depends on who it works for.

Token owner's roleWhat the agent can do over MCP
ViewerUse every read tool and reply in review threads with comment_on_proposal. It cannot open or change proposals.
Editor, Admin or OwnerUse every read tool, plus the write tools that draft and extend proposals, reply in threads, draft decisions with record_decision and update tasks with update_task.
Any roleNever approve, publish, invite members or edit settings. Those actions exist only in the web app.

Admins also set the workspace token policy. Personal access tokens covers creating and revoking tokens.

Remove a member

Remove someone from the member list. Their access ends at once: they can no longer sign in, and every personal access token they own is revoked. An agent still configured with one of those tokens gets an authentication error on its next call.

  • Their proposals, comments, decisions and revisions keep their name, so history stays accurate.
  • Open proposals they authored stay open, so an Editor can finish, approve or withdraw them.
  • Reassign their open tasks in Workstreams.

Warning

Shared setups stop too

A token revoked with its owner breaks every setup that used it, including CI jobs and shared agent configurations. Before someone leaves, move those setups to a token owned by a member who is staying.

Next steps