Roles and permissions
Understand Conversation user, member, admin and owner access, including Brain proposals and approvals.
TipOff has four workspace roles. Your role belongs to a specific workspace; a job title selected in these guides does not change it.
Conversation user (viewer)
This is the least-privilege role for asking questions and reading permitted workspace data. Its default capabilities are data viewing and agent use. Navigation includes Chat, Today, Companies & people and Connect AI.
Conversation users cannot import or enrich records, export, change tracking, refresh CRM lists, manage campaigns, view workspace usage, administer settings or confirm workspace changes. Their own AI connection keeps the same read-only role and tenant boundary; it is not an administrative credential.
Member
Members can use permitted working features, create personal lists, add notes, manage deals, read available campaigns, propose Brain changes and view usage. They do not receive campaign-management/start, workspace-settings, member-management, billing-management or integration-management rights by default. Each feature still applies its own checks.
Admin and owner
Admins manage workspace people, settings, integrations and billing, and have the management capabilities for radars, imports, approvals and campaigns. Owners have the same capability set as admins, with workspace ownership. Neither role is a TipOff platform-staff role. Provider availability, module access and operation-specific checks still apply.
Brain proposals and approvals
Applying or restoring Brain content requires an admin or owner with workspace-settings permission. Members can propose changes, but cannot apply them, even with a legacy Brain-management grant. Proposing is not applying.
Invite with the least access needed
An admin or owner opens Members & access, enters the teammate's email and chooses Conversation user, Member or Admin for the invitation. Owner is not an invitation option. Start with Conversation user when read-and-ask access is enough.
A sent invitation is not proof the teammate joined. Check its pending or accepted state. Role changes are managed separately for existing members. Do not share credentials or switch to another person's account to bypass a denial.