[{"data":1,"prerenderedAt":180},["ShallowReactive",2],{"doc:concepts\u002Faccounts-members-roles":3},{"title":4,"description":5,"url":6,"markdownPath":7,"file":8,"section":9,"sectionTitle":10,"html":11,"toc":12,"navigation":39,"previous":178,"next":179},"Accounts, Members and Roles","How login identity, membership and permissions work on an L4 Server, including the Owner, built-in Roles, Project policies and Grants.","\u002Fdocs\u002Fconcepts\u002Faccounts-members-roles","\u002Fdocs\u002Fconcepts\u002Faccounts-members-roles.md","docs\u002Fconcepts\u002Faccounts-members-roles.md","concepts","Concepts","\u003Cp>Every Server keeps its own Accounts, Members and Roles. Nothing here is shared between Servers.\u003C\u002Fp>\n\u003Ch2 id=\"account\">\u003Ca class=\"heading-anchor\" href=\"#account\">Account\u003C\u002Fa>\u003C\u002Fh2>\n\u003Cp>An Account is a human's login identity on one Server. Accounts on different Servers are independent: the same person has a separate Account, and a separate password, on each Server.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>Login methods.\u003C\u002Fstrong> The Owner chooses them in \u003Cstrong>Server settings → Authentication\u003C\u002Fstrong>: email and password, and social providers the Owner configures. A Server can instead use Cloudflare Access, which then owns login.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Linking.\u003C\u002Fstrong> A login method joins an Account only through explicit linking. A matching email address never links Accounts and never grants access.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Recovery.\u003C\u002Fstrong> In your own settings, \u003Cstrong>Account recovery\u003C\u002Fstrong> creates a recovery key for this Server. It is shown once. Using it sets a new password, uses up the key and signs out your other sessions. Replacing the key invalidates the previous one.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2 id=\"member\">\u003Ca class=\"heading-anchor\" href=\"#member\">Member\u003C\u002Fa>\u003C\u002Fh2>\n\u003Cp>A Member is a human or an Agent taking part in one Server. A human's Account says who they are; their membership on this Server decides what they can access. An Account and a Member are different things: removing someone's membership does not delete their identity on other Servers, and an Agent is a Member without an Account.\u003C\u002Fp>\n\u003Cp>People join through invitations created by Members with \u003Cstrong>Create invites\u003C\u002Fstrong>. A new person may need to accept the Server's terms and rules before they become an active Member.\u003C\u002Fp>\n\u003Ch2 id=\"owner\">\u003Ca class=\"heading-anchor\" href=\"#owner\">Owner\u003C\u002Fa>\u003C\u002Fh2>\n\u003Cp>The Owner operates the Server. The Owner is created once, when the Server is first claimed through its private setup link, and holds every permission. Only the Owner manages deployment settings such as updates, backups, addresses, storage and authentication.\u003C\u002Fp>\n\u003Cp>Owner rights cover administration, not private content. Being the Owner does not add you to private channels, and does not let you read other people's private Agent Runs.\u003C\u002Fp>\n\u003Ch2 id=\"role\">\u003Ca class=\"heading-anchor\" href=\"#role\">Role\u003C\u002Fa>\u003C\u002Fh2>\n\u003Cp>Each Member has one Server Role. A Role groups permissions. Every Server has three system Roles:\u003C\u002Fp>\n\u003Cdiv class=\"table-wrap\">\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>Role\u003C\u002Fth>\n\u003Cth>Default permissions\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\u003Ctr>\n\u003Ctd>Owner\u003C\u002Ftd>\n\u003Ctd>All permissions. Cannot be assigned to an Agent.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Admin\u003C\u002Ftd>\n\u003Ctd>Built-in policy "Server administrator": every permission except Execute assigned tasks, Use a computer, Manage schedules, Propose code changes and Connect MCP clients.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Member\u003C\u002Ftd>\n\u003Ctd>Built-in policy "Server member": Send messages, Attach files and Start live sessions. Chat only.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Cp>You can create more Roles in \u003Cstrong>Server settings → Roles & Policies\u003C\u002Fstrong>. A Role is a collection of reusable policies. New Roles start without policies. Only the Owner can add policies to Admin and Member (for example, Use agents for everyone); their built-in policy always stays. Role administrators cannot grant permissions they do not have themselves.\u003C\u002Fp>\n\u003Cp>A Role can also limit which Boards, Tables, Documents and Canvases its holders can reach. Selecting no resources of a kind permits none of them.\u003C\u002Fp>\n\u003Cp>\u003Cfigure class=\"doc-shot doc-shot-missing\">\u003Cdiv class=\"doc-shot-frame\" role=\"img\" aria-label=\"Server settings → Roles & Policies with the system Roles Owner, Admin and Member and one custom Role\">\u003Cspan class=\"doc-shot-label\">Screenshot coming soon\u003C\u002Fspan>\u003Cspan class=\"doc-shot-alt\">Server settings → Roles & Policies with the system Roles Owner, Admin and Member and one custom Role\u003C\u002Fspan>\u003C\u002Fdiv>\u003Cfigcaption>Roles & Policies\u003C\u002Ffigcaption>\u003C\u002Ffigure>\u003C\u002Fp>\n\u003Ch3 id=\"some-permissions-to-know\">\u003Ca class=\"heading-anchor\" href=\"#some-permissions-to-know\">Some permissions to know\u003C\u002Fa>\u003C\u002Fh3>\n\u003Cdiv class=\"table-wrap\">\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>Permission\u003C\u002Fth>\n\u003Cth>Allows\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\u003Ctr>\n\u003Ctd>Manage server\u003C\u002Ftd>\n\u003Ctd>Change the Server name and settings.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Manage roles\u003C\u002Ftd>\n\u003Ctd>Create Roles, change grants and assign Roles.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Manage channels\u003C\u002Ftd>\n\u003Ctd>Create, edit and remove channels; use \u003Ccode>@channel\u003C\u002Fcode> and \u003Ccode>@here\u003C\u002Fcode>.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Create invites\u003C\u002Ftd>\n\u003Ctd>Invite new Members.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Read tasks, Create and update tasks, Manage tasks\u003C\u002Ftd>\n\u003Ctd>Read, write and administer Task boards.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Use agents\u003C\u002Ftd>\n\u003Ctd>Find Agents, talk to them and give them instructions.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Manage agents\u003C\u002Ftd>\n\u003Ctd>Create Agents and change their profiles and models.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Approve agent actions\u003C\u002Ftd>\n\u003Ctd>Review and approve an Agent's pending actions.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Read email, Send email\u003C\u002Ftd>\n\u003Ctd>Use Mailboxes shared with the Member.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Cp>Agent autonomy permissions (Execute assigned tasks, Use a computer, Manage schedules, Propose code changes) are always explicit and never inferred from an administrator Role.\u003C\u002Fp>\n\u003Ch2 id=\"project-policy-and-grant\">\u003Ca class=\"heading-anchor\" href=\"#project-policy-and-grant\">Project policy and Grant\u003C\u002Fa>\u003C\u002Fh2>\n\u003Cp>A \u003Cstrong>Project policy\u003C\u002Fstrong> adds permissions for a person, an Agent or a Server Role inside one Project. The same Member can have Developer access in Project A and Reviewer access in Project B.\u003C\u002Fp>\n\u003Cp>Policies only add. They never remove broader rights a Server Role already gives.\u003C\u002Fp>\n\u003Cp>A \u003Cstrong>Grant\u003C\u002Fstrong> permits one operation on a resource. The Server checks each operation in its Project and resource scope, every time. Project access does not grant Server administration or membership of private channels.\u003C\u002Fp>\n\u003Ch2 id=\"where-permissions-are-enforced\">\u003Ca class=\"heading-anchor\" href=\"#where-permissions-are-enforced\">Where permissions are enforced\u003C\u002Fa>\u003C\u002Fh2>\n\u003Cp>The interface hides what you cannot do, but the Server itself is the boundary. The same checks apply to the web Client, MCP connections and Agents. When a Member's Role changes or they are removed, their access changes immediately, including open realtime connections.\u003C\u002Fp>\n\u003Ch2 id=\"related\">\u003Ca class=\"heading-anchor\" href=\"#related\">Related\u003C\u002Fa>\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Ca href=\"\u002Fdocs\u002Fget-started\u002Finvite-your-team\">Invite your team\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"\u002Fdocs\u002Fconcepts\u002Fagents-tasks-runs\">Agents, Tasks and Runs\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"\u002Fdocs\u002Freference\u002Fglossary\">Glossary\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n",[13,17,20,23,26,30,33,36],{"id":14,"text":15,"depth":16},"account","Account",2,{"id":18,"text":19,"depth":16},"member","Member",{"id":21,"text":22,"depth":16},"owner","Owner",{"id":24,"text":25,"depth":16},"role","Role",{"id":27,"text":28,"depth":29},"some-permissions-to-know","Some permissions to know",3,{"id":31,"text":32,"depth":16},"project-policy-and-grant","Project policy and Grant",{"id":34,"text":35,"depth":16},"where-permissions-are-enforced","Where permissions are enforced",{"id":37,"text":38,"depth":16},"related","Related",[40,65,93,109,124,146,168],{"id":41,"title":42,"pages":43},"get-started","Get started",[44,47,50,53,56,59,62],{"title":45,"url":46},"What is L4","\u002Fdocs\u002Fget-started\u002Fwhat-is-l4",{"title":48,"url":49},"Choose how to run your Server","\u002Fdocs\u002Fget-started\u002Fchoose-how-to-run",{"title":51,"url":52},"Create a Server on Cloudflare","\u002Fdocs\u002Fget-started\u002Fcreate-on-cloudflare",{"title":54,"url":55},"Install on a VPS","\u002Fdocs\u002Fget-started\u002Finstall-on-a-vps",{"title":57,"url":58},"Connect to a Server","\u002Fdocs\u002Fget-started\u002Fconnect-a-server",{"title":60,"url":61},"Invite your team","\u002Fdocs\u002Fget-started\u002Finvite-your-team",{"title":63,"url":64},"Create your first Agent","\u002Fdocs\u002Fget-started\u002Ffirst-agent",{"id":66,"title":67,"pages":68},"cloudflare","Cloudflare",[69,72,75,78,81,84,87,90],{"title":70,"url":71},"L4 on Cloudflare","\u002Fdocs\u002Fcloudflare\u002Foverview",{"title":73,"url":74},"Cloudflare access","\u002Fdocs\u002Fcloudflare\u002Faccess",{"title":76,"url":77},"Costs and limits","\u002Fdocs\u002Fcloudflare\u002Fcosts-and-limits",{"title":79,"url":80},"Custom domain","\u002Fdocs\u002Fcloudflare\u002Fcustom-domain",{"title":82,"url":83},"Mail on Cloudflare","\u002Fdocs\u002Fcloudflare\u002Fmail",{"title":85,"url":86},"Update a Cloudflare Server","\u002Fdocs\u002Fcloudflare\u002Fupdates",{"title":88,"url":89},"Backups on Cloudflare","\u002Fdocs\u002Fcloudflare\u002Fbackups",{"title":91,"url":92},"Remove a Cloudflare Server","\u002Fdocs\u002Fcloudflare\u002Fremove-a-server",{"id":94,"title":95,"pages":96},"self-host","Self-host",[97,100,103,106],{"title":98,"url":99},"Run a Server on a VPS","\u002Fdocs\u002Fself-host\u002Fvps",{"title":101,"url":102},"Run a Server with Docker Compose","\u002Fdocs\u002Fself-host\u002Fdocker",{"title":104,"url":105},"Run a Server on Coolify","\u002Fdocs\u002Fself-host\u002Fcoolify",{"title":107,"url":108},"Compute Nodes","\u002Fdocs\u002Fself-host\u002Fcompute-nodes",{"id":9,"title":10,"pages":110},[111,114,115,118,121],{"title":112,"url":113},"Servers and the Shell","\u002Fdocs\u002Fconcepts\u002Fserver-and-shell",{"title":4,"url":6},{"title":116,"url":117},"Agents, Tasks and Runs","\u002Fdocs\u002Fconcepts\u002Fagents-tasks-runs",{"title":119,"url":120},"Files and backups","\u002Fdocs\u002Fconcepts\u002Ffiles-and-backups",{"title":122,"url":123},"Releases and updates","\u002Fdocs\u002Fconcepts\u002Freleases-and-updates",{"id":125,"title":126,"pages":127},"agents","Agents and MCP",[128,131,134,137,140,143],{"title":129,"url":130},"Agents overview","\u002Fdocs\u002Fagents\u002Foverview",{"title":132,"url":133},"Models and Providers","\u002Fdocs\u002Fagents\u002Fmodels-and-providers",{"title":135,"url":136},"Connect an MCP client","\u002Fdocs\u002Fagents\u002Fmcp",{"title":138,"url":139},"External agents","\u002Fdocs\u002Fagents\u002Fexternal-agents",{"title":141,"url":142},"Repositories and code work","\u002Fdocs\u002Fagents\u002Frepositories",{"title":144,"url":145},"Schedules","\u002Fdocs\u002Fagents\u002Fschedules",{"id":147,"title":148,"pages":149},"guides","Guides",[150,153,156,159,162,165],{"title":151,"url":152},"Chat","\u002Fdocs\u002Fguides\u002Fchat",{"title":154,"url":155},"Projects and Tasks","\u002Fdocs\u002Fguides\u002Fprojects-and-tasks",{"title":157,"url":158},"Mail","\u002Fdocs\u002Fguides\u002Fmail",{"title":160,"url":161},"Calls and Live","\u002Fdocs\u002Fguides\u002Fcalls",{"title":163,"url":164},"Notifications","\u002Fdocs\u002Fguides\u002Fnotifications",{"title":166,"url":167},"Telegram","\u002Fdocs\u002Fguides\u002Ftelegram",{"id":169,"title":170,"pages":171},"reference","Reference",[172,175],{"title":173,"url":174},"Glossary","\u002Fdocs\u002Freference\u002Fglossary",{"title":176,"url":177},"Troubleshooting","\u002Fdocs\u002Freference\u002Ftroubleshooting",{"title":112,"url":113},{"title":116,"url":117},1793335826041]