Team management

Written by Joseph Russo, Principal Architect, Networks and Tech, AskVault · Reviewed by Allison Chan

Last updated: October 3, 2026 · 4 min read

TL;DR

Invite up to 10 team members on Business (4 on Growth, 1 on Starter). Four account-level roles plus four workspace-scoped roles. Pending invites expire after 7 days. Full audit log per member. Two-factor auth optional, required on Enterprise.

Team capacity per plan

Plan	Team members	Workspaces
Free	1	1
Starter	1	2
Growth	4	5
Business	10	15
Enterprise	Unlimited	Unlimited

If you need more seats than your plan offers, upgrade or contact sales.

Teammates use the owner's plan (rolling out, not yet switched on)

Once this change is switched on, the features below follow the workspace owner's plan:

• Features follow the owner's plan. A teammate gets the features of the plan the owner pays for, everywhere in a shared workspace: the Live chat inbox and help desk, AI reply suggestions, analytics, AI Insights, webhooks, skills, exports and the Setup Copilot. The teammate's own plan on a separate account does not matter.
• AI usage is counted against the owner's allowance. It is not counted against the teammate's.
• Pending invites hold a seat. On a 4-seat plan with 3 members and 1 open invite, the next invite waits until a seat frees up. An invite expires after 7 days and then frees its seat.
• Seats are re-checked when an invite is accepted. If the owner moved to a smaller plan after sending the invite, the invite can only be accepted once a seat is free. Members who have already joined are never removed.
• Only the owner can invite an admin. This applies on the Team page and in the Setup Copilot.

Two role layers

Distinct from each other:

Account-level roles. Apply across all workspaces in your account.

• Account Owner. Created the account. Single owner. Full control.
• Account Admin. Can manage all workspaces, billing, team. Multiple allowed.
• Account Member. Standard team member. Workspace-scoped roles further constrain.
• Account Viewer. Read-only across the account.

Workspace-scoped roles. Apply per-workspace, layered on top.

• Workspace Owner. Full workspace control. Default: account-owner.
• Workspace Admin. Configure settings, integrations, skills. Can't delete.
• Workspace Editor. Knowledge + Conversations write access. No settings.
• Workspace Viewer. Read-only.

A user can be Account Admin but Workspace Viewer for a specific workspace. Granular control.

Inviting a team member

Five clicks:

1. Open Settings > Team > Invite.
2. Enter email.
3. Pick account-level role.
4. Pick per-workspace roles (one row per workspace).
5. Send invite.

The invitee gets an email with a signup link. Link expires in 7 days.

Once accepted:

• Invitee signs in or creates an AskVault account with the invited address (password, Google or GitHub).
• They land in the workspace.

The invite can only be accepted by an account whose email matches the invited address. We are also rolling out a second check: the invitee's email must be verified before they can join. Google and GitHub sign-ins are already verified; a password account is verified by clicking the link in our verification email. This stops someone who registered the invited address, but never received mail at it, from taking the seat.

Pending invites

The team page lists:

• Email.
• Invited at timestamp.
• Expires at (7 days from invite).
• Resend button.
• Cancel button.

Resend if the original email got lost. Cancel if you changed your mind.

Copy link. The workspace owner can copy a pending invite's link to send it another way. As part of the same rollout, only the owner will see invite links; admins still see who is invited and the invite email still carries the link. Treat a copied invite link like a password: anyone holding it can try to accept it.

Changing a member's role

Two-click change:

1. Click the member's row.
2. Update account-level or per-workspace role.
3. Save.

A role change takes effect on the member's next request, because roles are checked every time. Their dashboard shows the change on the next page load.

Removing a team member

Three steps:

1. Open the member's profile.
2. Click "Remove from account".
3. Confirm.

Removal:

• Ends their access to this workspace on their next request. Their AskVault login itself still works for any other workspaces they belong to.
• Records the removal in the activity log.
• Keeps their replies and notes in conversation history.
• Doesn't delete contact data or knowledge sources they uploaded.
• Closes their open live-chat inbox (rolling out, not yet switched on). Once this is on, an inbox the removed member still has open disconnects at once: it stops receiving new escalations, can't open or reply to conversations, and leaves the auto-assign pool. Until then, an inbox left open keeps receiving live conversations until they close or reload it.

If the removed member was a sole admin of a workspace, you must promote another admin first to avoid orphaning.

Workspace-scoped pools

For role-specialization patterns:

• Billing agents. Members with workspace-Editor role plus the billing tag.
• Senior agents. Workspace-Admin role plus senior tag.
• Engineering on-call. Workspace-Editor plus engineering tag.

Automation rules can route conversations to specific pools. See also claim conversations.

Multi-factor authentication

Optional but recommended:

• TOTP authenticator (Google Authenticator, 1Password, Authy).
• SMS backup for recovery (if TOTP device lost).

Enable per-user under Account Settings > Password & Security > Two-Factor Auth.

On Enterprise, 2FA can be required workspace-wide. Members without 2FA can't sign in until they set it up.

Single Sign-On (SSO)

SSO is not yet available on any plan, including Enterprise.

AskVault does not currently support SAML 2.0, OIDC, JIT provisioning, or SCIM, and there is no SSO section under Account Settings. SSO/SAML is on the roadmap with no committed date. Contact sales if this is a blocker for your evaluation.

Sign-in methods that work today:

• Email and password, with optional two-factor authentication (above).
• Google social sign-in.
• GitHub social sign-in.

Off-boarding is therefore manual. There is no identity provider to de-provision from, so remove the person yourself under removing a team member above.

If your goal is to gate widget content to employees your own identity provider has already authenticated, identity verification does that today using an HMAC signature from your backend. That is a separate mechanism from signing in to the AskVault dashboard.

Audit log per member

For each team member:

• Last login timestamp and IP.
• Conversations claimed and resolved.
• Knowledge edits.
• Settings changes.
• API keys created or rotated.
• Skill configuration changes.

Visible in the activity log. Audit entries are kept for 365 days.

Useful for compliance audits and offboarding reviews.

Role permissions matrix

What each role can do:

Action	Owner	Admin	Editor	Viewer
View dashboard	Yes	Yes	Yes	Yes
View conversations	Yes	Yes	Yes	Yes
Reply to conversations	Yes	Yes	Yes	No
Edit knowledge	Yes	Yes	Yes	No
Configure skills	Yes	Yes	No	No
Manage integrations	Yes	Yes	No	No
Invite team members	Yes	Yes	No	No
Manage billing	Yes	No	No	No
Delete workspace	Yes	No	No	No

Custom roles available on Enterprise.

Sample team structure

A typical mid-size support team:

• 1 Account Owner. CEO or VP.
• 2 Account Admins. Head of support, Head of operations.
• 5 Account Members with Workspace Editor. Frontline support agents.
• 2 Account Members with Workspace Editor + senior tag. Senior agents (escalation handlers).

Plus, for cross-functional access:

• 1 Workspace Viewer. Marketing reviewing customer sentiment.
• 1 Workspace Viewer. Engineering monitoring sentiment for product issues.

Total: 10 seats (Business plan limit). Larger teams need Enterprise.

Self-service offboarding

When an employee leaves:

1. Open Team Management.
2. Find the member.
3. Click Remove.
4. Their access to the workspace ends on their next request.

Workspace API keys belong to the workspace, not the person, so rotate any keys the departing member had copied. For broader offboarding (Slack, GitHub and so on), AskVault is one stop in your IT runbook; there is no public API for team changes yet.

Planned features (on the roadmap)

Documented for accuracy:

• Single sign-on and SCIM provisioning. Today, manual invites only. SAML 2.0 and OIDC single sign-on, JIT provisioning, and SCIM 2.0 automated lifecycle are not available yet, with no committed date.
• Custom roles. Today, fixed roles. Granular permission rules per role planned for Enterprise.
• Team templates. Today, manual setup. Pre-built team templates (support team, sales team, internal helpdesk) planned.
• Audit log export. Today, view in dashboard. Native export to SIEM (Splunk, Datadog) planned.

Limits

• Team members per account. Plan-dependent (1 to 10 plus unlimited Enterprise).
• Pending invite expiry. 7 days.
• Role changes per minute. 10 (rate-limited to prevent accidental mass-changes).
• Audit retention. 365 days standard.

Common pitfalls

Invite never received. Check spam. If still missing, cancel and resend.

Member sees too little. Workspace-scoped role too restrictive. Bump to Editor for full conversation access.

Member sees too much. Workspace-scoped role too permissive. Lower to Viewer for read-only.

Removed member can still log in. That is expected: removal takes away this workspace, not their AskVault account. They will no longer see or open it.

Sole admin removed. Workspace orphaned. Promote another admin first.

FAQ

Can a single user be in multiple accounts?

Yes. Same email can be invited to multiple accounts. The user picks which account at login.

What happens to an invitee's data if they don't accept?

Nothing. No account is created until acceptance. Pending invites carry no data.

Can I bulk-invite via CSV?

Today, no native bulk-invite. Use the Team API to loop through emails. CSV bulk-invite is planned.

Does the team count include API-key-only service accounts?

Today, API keys are not counted as team members. Each key is an anonymous service principal. Named service accounts are planned.

Can I export team activity for HR or compliance?

An activity log with an export is rolling out and may not be on for your account yet. See activity log.

Related guides

• Login and signup
• Google OAuth login
• Workspace settings
• Audit and compliance
• Account deletion

See RAG-grounded answers in action

AskVault answers from the content you index, shows its sources by default, and says so when it finds nothing.

Try AskVault Free → Read the API docs

Was this page helpful? Yes No