Three roles, one rule each.
Admin. Full control: sources, settings, team, plans, and everything Standard members can do.
Standard. The working seat: triage and move recommendations, add notes, run syncs, compose and publish reports, use Ask Omni fully.
Read only. Reads everything shared, changes nothing. Read only seats see every finding, recommendation, published report, and conversation, and can ask questions in Ask Omni, but every control that would change shared state is simply not shown to them. It is the right seat for stakeholders and clients who need the picture without the keys.
How enforcement works. Permissions are enforced on the server, not just hidden in the interface. A Read only member cannot change anything even by crafting a request directly.
Two places a person can belong. Access is granted at one of two levels. Workspace access gives a role across every portfolio in the workspace. Portfolio access gives a role in specific portfolios only, and such a person never sees the workspace's controls: no workspace member list, no plan or billing, no workspace settings. Portfolio access is the right grant for a client contact or an outside stakeholder.
Roles are per workspace. One account can belong to several workspaces, with a different role in each. Being an Admin somewhere gives no authority anywhere else. An account can hold access to up to 10 workspaces in total.
Owners. Every workspace has one owner: the account responsible for it. Ownership can be transferred; contact support if you need a workspace's ownership moved.
Invites. Admins and Standard members invite by email and set the role at invite time, up to their own role. Invitations now name their scope (the whole workspace, or specific portfolios) alongside the role. An address that already has access in a workspace can't be invited to it again; change their role on their row instead. Roles can be changed later from Settings. During early access, a workspace can have up to 3 members.