# Invite people and change roles

Add people to a workspace, change their roles, or remove them.
Admins manage people. Anyone can invite people at their own role or below.

## Ask your agent

> How do I invite a teammate to my Zero Cool workspace as a Member?

The agent runs `zerocool invitations send`. The person accepts the invitation in the browser.

## In the portal

**Invite a person**

1. Open the workspace and select **Invite person**. Admins also find it in **Settings → People**.
2. Enter the **Email** and choose the **Role**: **Viewer**, **Member** or **Admin**.
   The default is **Viewer**. Choose **Member** for a person who starts audits.
3. Select **Send invitation**. The invitation expires in 7 days.
4. The person opens the email link, signs in and selects **Accept invitation**.

**Change a role or remove a person**

1. Open **Settings → People**.
2. Under **Members**, change the person's **Role**, or select **Remove** and confirm **Remove**.

The portal does not let you change your own role. An unfunded workspace must keep at least one Admin.
To cancel an invitation, select **Revoke** under **Pending invitations**, then confirm **Revoke**.
Only an Admin can leave a workspace. In **Settings → People**, select **Leave workspace** on your own row.
Confirm **Leave workspace**.
Another Admin must remain in the workspace.

[Roles](/docs/features) lists what each role can do.
To give read access to one audit only, [share the audit](/docs/flows/comment-share) instead.

## CLI

```sh
zerocool invitations send EMAIL --role member --workspace Acme
zerocool invitations list --workspace Acme
zerocool invitations revoke EMAIL --workspace Acme
zerocool members list --workspace Acme
zerocool members set-role EMAIL --role admin --workspace Acme
zerocool members remove EMAIL --workspace Acme
```

The `invitations revoke` and `members remove` commands ask you to confirm.
A coding agent must show you which invitation or membership it will remove and wait for your approval.
Once approved, it runs the command with `--yes`.

Your Account's workspace role and your API key's role ceiling both limit these commands.
Accepting an invitation needs the browser.
The CLI can change your own membership role. An unfunded workspace must keep at least one Admin.
Member lists show direct memberships. Admins of a funding workspace also have inherited Admin access to its funded workspaces.
Removing a person from a funding workspace also removes their memberships in its funded workspaces and their keys scoped to those memberships.