Invite teammates

Goal

You'll add a colleague to your Measured Cloud workspace with the right role, so they can view results (or edit rules and validations) without sharing your account.

Prereqs

• You are a Super admin (for org-wide invites) or Workspace admin (for invites into a workspace you administer).
• SMTP is optional. Measured Cloud always returns the invite URL in the mint response so you can forward it out-of-band; outbound invite mail is tracked separately (PARITY-7).

Roles, briefly

Role	What it can do
Super admin	Everything, across the whole org, including managing members, tokens, billing and roles.
Technical admin	Org settings, integrations and tokens, plus the data-source connections in every workspace — but no data assets, results or user management. Can see the SSO providers but not add or change them.
Workspace admin	Manages teams, members and every data change within one workspace.
Team admin	Manages the members of one team — no data access.
Editor	Creates and edits data sources, rules, validations, schedules, and alerts.
Viewer	Read-only on results, anomalies, profile runs. A workspace admin can mark a viewer restricted, which hides data assets flagged as sensitive.

Full definitions in Multi-tenancy concepts.

Steps

1. Navigate to Settings → Members.
2. Click Invite teammate.
3. Enter the colleague's email, pick a role, and pick a workspace (or leave it blank for an org-wide invite — super admin / technical admin only).
4. Click Send invite. Measured Cloud mints a one-time dqi_… invite token and returns an invite_url. The URL is valid for INVITE_EXPIRY_DAYS (default 7).
5. Forward the URL to the teammate however you like (email, Slack DM, ticket).
6. Your teammate opens the URL, sets a display name + password, and is signed in directly into the workspace at the role you chose.

If your org has SSO enforced (Configure SSO), the accept-invite page redirects to the IdP instead of asking for a password — the user is JIT-provisioned through the SSO callback with the role on the invite.

Manage existing members

What you see on the same Settings → Members page depends on your role.

Super admins see All members: everyone in the organization, with their org role and every workspace and team they belong to. To change what someone can reach, click their row (or its edit icon) to open Workspace access. It lists every workspace in the organization, and for each one:

• No access: pick a role (Workspace Admin, Editor or Viewer) and click the + button to add them. A new viewer starts unrestricted, unless they're already restricted at the organization level or through a team in that workspace, in which case they start restricted.
• A role: change it from the picker, or remove their access with the red remove button (you're asked to confirm first). For a viewer, set Viewer access to restricted or unrestricted.
• Also through team …: they reach this workspace through a team as well. A team grant is managed on Settings → Teams; their effective role is the higher of the two.

A Super Admin has access to every workspace through their org role. Their Workspace access shows "Super Admin (org role)" on every workspace, read-only: that access can't be narrowed per workspace. Each control is disabled, with a "Requires …" tooltip, when you don't have the permission it needs (managing workspace users, or the viewer restricted flag). The role pickers offer only the workspace roles you're allowed to grant.

Workspace admins (and anyone else who can't see the whole organization) see Members of workspace: the current workspace's members, where they can change a member's role, remove them, and set a viewer's Access. Super admins appear there read-only, because their access comes from their org role. To manage another workspace, switch to it first.

Role changes take effect on the next authenticated request. Removing access asks you to confirm first; once confirmed it deletes the workspace membership (the person stays in the organization) and they lose access at the same point. Changing a role, adding or removing access asks you to confirm your password if you haven't recently.

Verify

• The new member shows up in Settings → Members with the role you assigned.
• Logged in as them, they see (or do not see) the actions allowed by their role.