# Roles and access

Everyone in a workspace can read and edit all of it, and workspace membership is the only thing that decides access. Views, filters, hidden properties and sidebar settings only change what is shown.

## Roles

| Role | Can |
| --- | --- |
| Member | View and edit all content in the workspace |
| Workspace admin | Invite, approve and remove users, make other users admins, change workspace settings, plugins, exports and other workspace-level options |
| Account owner | The account name and URL, creating workspaces, and closing the account. An owner is an admin in every workspace they belong to, but joins a workspace like anyone else: an admin there has to invite or approve them |

Someone can be an admin in one workspace and a plain member in another. Keep at least two admins per workspace so nobody is locked out when one leaves.

## A workspace per audience

The company handbook, a founders' workspace, a client project: each is a workspace with its own members. Inside a workspace, use collections to organize pages; access is the same for all of them. Your Journal is in the workspace too, so personal notes belong in a workspace of your own.

## Removing someone

In **Settings → Manage Users**, remove the person from each workspace they are in. Their devices are signed out of the workspace the next time they connect. Before that, reassign their tasks and owned pages, and update the start page if it points to them.

Removal takes away access from now on. It cannot take back what someone already copied or downloaded, and the workspace key is not rotated automatically. If a key must be replaced, move the content into a new workspace. See the [security white paper](https://thymer.com/whitepaper).