> ## Documentation Index
> Fetch the complete documentation index at: https://documents.xobito.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Team & Roles Overview

> Invite staff into your Xobito workspace, assign a role, and keep track of what they do.

Xobito lets you bring in as many teammates as your plan allows. Every teammate has exactly one **role**, and that role decides what they can see and do.

<Note>
  The person who first creates a Xobito workspace is the **workspace owner**. Owners bypass the role system entirely — they have full access to every feature. Everyone else is subject to the role they've been assigned.
</Note>

## The three building blocks

<CardGroup cols={3}>
  <Card title="Staff Members" icon="user-plus" href="/team/staff-members">
    Invite new users, edit existing ones, remove people who've left.
  </Card>

  <Card title="Roles & Permissions" icon="shield-halved" href="/team/roles-permissions">
    Build custom roles by ticking permissions from the 77-item list.
  </Card>

  <Card title="Activity Log" icon="clipboard-list" href="/team/activity-log">
    See who did what — contact edits, campaign sends, template submissions, and more.
  </Card>
</CardGroup>

## How they fit together

<Steps>
  <Step title="You create roles">
    A role is a named bundle of permissions. Start with the default **Agent** role or create your own.
  </Step>

  <Step title="You invite staff">
    When you invite someone, you pick which role they have. They'll only be able to use the features that role allows.
  </Step>

  <Step title="Xobito records their actions">
    Every time a staff member does something meaningful — creating a contact, sending a campaign, editing a bot — an entry lands in the Activity Log.
  </Step>
</Steps>

## The default role

When a workspace is first provisioned, exactly **one role** is created automatically:

| Role      | Default permissions     |
| --------- | ----------------------- |
| **Agent** | `tenant.chat.view` only |

That's it. The Agent role exists so that new staff can at least open the chat inbox the moment they're invited. Anything else — contacts, campaigns, templates, settings — the owner needs to either extend the Agent role or create additional roles like "Manager" or "Admin".

<Tip>
  There is **no pre-seeded "Admin" role**. The workspace owner is implicitly an admin through their account flag (`is_admin`); they don't use the role system. To give another teammate admin-like access, create a role, tick every permission you want, and assign them to it.
</Tip>

## Who can manage the team?

To invite, edit, or remove staff, a user needs:

* `tenant.staff.view` — to see the staff list.
* `tenant.staff.create` — to invite new members.
* `tenant.staff.edit` — to change someone's role or details.
* `tenant.staff.delete` — to remove a staff member.

To manage roles themselves:

* `tenant.role.view`
* `tenant.role.create`
* `tenant.role.edit`
* `tenant.role.delete`

The workspace owner has all of these automatically.

## Workspace owner bypass

Any user with the `is_admin` flag — normally just the workspace owner — bypasses every permission check. They can do anything the workspace is capable of, regardless of what role they hold. Keep the number of admins small.

## What's next

<CardGroup cols={2}>
  <Card title="Invite your first teammate" icon="user-plus" href="/team/staff-members">
    Send an invite and pick a role.
  </Card>

  <Card title="Build a custom role" icon="shield-halved" href="/team/roles-permissions">
    The full permission reference.
  </Card>

  <Card title="See who's doing what" icon="clipboard-list" href="/team/activity-log">
    Audit trail of workspace actions.
  </Card>
</CardGroup>