Team and roles

#Overview

Everyone in your company works in one workspace. What each person can do depends on their role. Converge has four built-in roles (Owner, Admin, Engineer, Viewer), and you can add custom roles. The server checks every permission on every request; the app also hides or dims what your role does not allow and says why.

Open Team under Account in the left menu. It has three tabs: Members, Roles & permissions and Audit log.

#Built-in roles

By default, Engineers submit versions for review and Owners or Admins approve them.

#Permissions

A module permission lets a person open the module. Opening a seat-licensed module also takes one of the company's seats, so a Viewer uses a seat too. See Licences and seats.

When a permission is missing, the app and the API show the same message, for example: "You do not have permission to use simulation. Ask your company owner or an admin to change your role."

#Invite a colleague

You need Invite members.

1. Open Team → Members.
2. Enter their email (for example [email protected]) and choose a Role.
3. Select Invite. Converge emails them a link valid for 7 days.

The member shows as Invite pending until they accept. Inviting the same address again re-sends the invite. An email that already has a Converge account cannot be invited.

The Free and Student plans allow 3 team members, counting active members and pending invites. Professional and Enterprise have no member limit.

#Change a role or remove a member

You need Manage members and roles.

• Change a role: choose a new role in the member's Role list.
• Remove: select Remove on their row and confirm. Their sessions and seats end with the account.

A role change takes effect at once on the server. If it removes a module permission while the person has that module open, their seat ends at the next check-in (within a minute) and the module closes with the permission message.

#Custom roles

Open Team → Roles & permissions. You need Manage members and roles to change anything.

• New role: give it a name (for example "Contractor"), optionally Copy permissions from an existing role, and tick permissions in the matrix.
• Edit a built-in role: tick or untick its permissions. Built-in roles keep their names.
• Reset a built-in role to its default permissions.
• Delete a custom role. Move its members to another role first; a role that has members cannot be deleted.

Custom role names must be unique and cannot reuse a built-in name.

#Guards against escalation

These rules apply to everyone except the Owner:

• You can give a role only if you hold every permission it contains.
• You can grant a permission to a role only if you hold it yourself.
• Only the Owner can give, create or edit a role that includes Manage members and roles, or change or remove someone who has it. Admins cannot promote, demote or remove each other.
• Nobody can change their own role or remove themselves, and nobody can edit the role they are on.

Every role and member change is written to the audit log with the before and after values.

#API keys act as their member

An API key carries the permissions of the member who created it, and nothing more. Team, role, seat and key management never accept an API key; they need a signed-in session. See API keys.

#Related

• Licences and seats
• Audit log
• Review and sign-off
• Security