Understand workspace roles and website access

Permissions belong to a workspace. A member's role and website assignment work together; being an Admin does not always mean having every workspace-management control.

The roles

Role	Access in Brightstone
Owner	The workspace owner manages its sites, team, billing and settings.
Admin	Manages permitted sites. Workspace-wide settings, team and billing management require all-site access.
Finance	Reads authorized reporting and can view billing. Cannot manage the subscription or edit workspace targets just because the role is Finance.
Viewer	Reads authorized reporting without editing sites, integrations or workspace settings.

Members can still manage supported personal features, such as their own preferences and notifications, within the current plan and permissions. A Viewer should not need access to restricted Workspace Settings to manage their own AI Connections.

All sites or selected sites

All sites and selected-site assignments are separate from the role. Selected-site members see only the sites assigned to them. Removing an assignment removes access to that site's reporting.

An all-site Admin can manage workspace-wide controls; a selected-site Admin can manage allowed individual sites without gaining team or billing management.

Invitations and role changes

Workspace managers invite an Admin, Finance member or Viewer from Team. Owner is not an invitation choice and cannot be reassigned through the ordinary member-permissions form.

If a button or page is missing, ask the owner to check both the role and site assignment. Signing out or using an AI assistant does not grant extra rights.

An external AI connection also keeps the member's current permissions and its originally approved website list.