Members and roles

Members are the people with a console account in your workspace: the people who share previews and the people who administer them. Viewers are not members and never need an account.

Every member has a base role over the whole workspace. Grants add roles on top, to a person or a group, over the whole workspace, one share group or one preview. Everything is under Members & roles.

Base roles

Role	Can	Takes a seat
Owner	Everything, including transferring ownership and deleting the workspace. A workspace always has at least one	Yes
Admin	Everything except ownership. Can grant any role except Owner	Yes
Member	Opens previews and runs the ones they opened: viewers, hostnames, TCP services, extend, end, plus Insights and viewer exports for them. Uses the browser terminal on any preview they are invited to. Sees agents, domains, members and settings	Yes
Billing	Plan, seats and invoices. Sees members and settings; no previews	No
Auditor	Reads everything, including the activity log; exports the activity log, insights and viewer lists. No browser terminal. Changes nothing	No
No workspace role	Nothing until granted a role on a share group or a preview	No

There is also a built-in Preview manager role, meant to be granted on a share group or one preview: it runs previews and their viewers there, whoever opened them.

Invite members

Members & roles → Members → Invite.
People: existing members, groups, or new email addresses.
Role and scope: the role, and where it applies: the whole workspace, a share group or one preview. A choice you cannot grant is shown disabled, with the reason.
Review and send. New people get an email and sign in with a code.

An invitation lasts 7 days. Unanswered ones are listed under Pending invites, with Resend (which renews the 7 days) and Revoke. An invited person can sign in at once, with or without the email.

If the address already has a Houseguest™ account in another workspace, the invitation adds this workspace to it. See Several workspaces.

Change, disable, remove

On a member’s page, or the row menu on Members:

Base role: change it (needs Assign roles; only an Owner changes an Owner).
Grants: each role the person holds, where, and whether directly or through a group. Revoke a direct grant.
Effective permissions: what the person can do, by area, and where each permission comes from.
Disable: the person cannot open this workspace and is signed out; their roles stay for when they are enabled again.
Remove: ends their membership here, with their direct grants and group memberships. Their other workspaces are untouched. Previews they opened stay open.
Reset sign-in methods: removes their passkeys, authenticator app and recovery codes and signs them out. Not available for someone who also belongs to another workspace: Houseguest support resets those.

Select several members for bulk Disable, Enable or Remove. Export downloads the list as CSV.

Custom roles

Members & roles → Roles & permissions shows every role and a comparison matrix. Built-in roles cannot be edited; Duplicate starts a custom role from one. A custom role has a name, a description and any set of the permissions below except Own the workspace. You can never put a permission you do not hold yourself into a role.

Permissions

Permissions marked scopable also work when granted on one share group or one preview; the others apply only workspace-wide.

Area	Permission	Lets a person	Scopable
Previews	View previews	See previews, their hostnames and viewers	Yes
Previews	Create previews	Open new previews on hostnames the workspace’s agents forward, and terminal shares
Previews	Manage own previews	Edit hostnames of previews they opened; with extend and end, run them	Yes
Previews	Manage any preview	Edit, extend and end previews opened by anyone	Yes
Previews	Extend previews	Push a preview’s end out, up to 7 days from now	Yes
Previews	Extend past 7 days	Push a standing-access preview’s end more than 7 days out	Yes
Previews	End previews	Close a preview for every viewer at once	Yes
Viewers & standing access	Invite viewers	Send invites and add addresses to a preview	Yes
Viewers & standing access	Revoke viewers	Remove a viewer and end their sessions	Yes
Viewers & standing access	Manage standing access	Edit standing-access lists, including `@domain` entries	Yes
Viewers & standing access	Export viewer list	Download a preview’s viewers and their request counts as CSV	Yes
Agents	View agents	See agents, their status and hostnames
Agents	Add agents	Create join tokens and install commands
Agents	Turn hostnames on and off	Choose names within an agent’s ceiling
Agents	Remove agents	Disconnect and remove an agent
Domains & addresses	View domains	See domains and their verification state
Domains & addresses	Manage domains	Add, verify and remove domains
Domains & addresses	Use Houseguest addresses	Open previews on Houseguest addresses, including terminal shares	Yes
TCP & SSH	Add TCP services	Add TCP services an agent reports to a preview	Yes
TCP & SSH	Use the browser terminal	Open the browser terminal on a preview’s SSH services, as one of its viewers. Viewers outside the workspace are not affected	Yes
Insights & audit	View insights	Charts of views, sign-ins, refusals and terminal-share time, for the previews it covers	Yes
Insights & audit	Export insights	Download Insights’ daily figures as CSV, for the previews it covers	Yes
Insights & audit	View activity log	Read every recorded action in the workspace
Insights & audit	Export activity log	Download the activity log, or stream it to a SIEM
Members & roles	View members	See members, groups and their roles
Members & roles	Invite members	Invite people with roles they themselves hold	Yes
Members & roles	Remove members	Remove or disable people and end their sessions
Members & roles	Assign roles	Grant and revoke roles, never beyond what they hold	Yes
Members & roles	Manage custom roles	Create, edit and delete custom roles
Members & roles	Manage groups	Create groups and share groups, and change who and what is in them	Yes
Workspace	View settings	Read workspace and security settings
Workspace	Change settings	Workspace name and viewer settings
Workspace	Change security settings	Console sessions, sign-out everywhere, second sign-in policy, SIEM streaming
Workspace	View billing	Plan, usage and invoices
Workspace	Manage billing	Change plan and seats
Workspace	Own the workspace	Transfer ownership and delete the workspace. Owner only

View insights and Export insights cover the previews they are held on: a Member’s own previews, a share group, one preview, or every preview when held across the workspace. Someone granted View insights on one preview sees Insights for that preview alone.

Use the browser terminal applies to people who are members of the workspace and also viewers of the preview. Viewers from outside the workspace use the terminal whenever the preview includes an SSH service.

Some permissions include others: for example Manage any preview includes extend and end, and Manage standing access includes inviting. The role editor ticks and locks what comes included.

Guardrails

Enforced on every change, not only in the page:

Nobody grants beyond what they hold at that scope, and revoking follows the same rule.
Only Owners grant Owner, and only an Owner changes an Owner.
Custom roles never exceed their editor.
Adding someone to a group hands them the group’s roles, so it needs the right to grant those roles.
The workspace keeps one Owner. Removing, disabling, demoting or ungrouping the last one is refused; the last Owner’s row shows a lock instead of a menu.
Invites only where you may invite. A share-group admin invites into that group, never wider.

A preview you cannot see answers “not found”. One you can see but not change says which permission is missing: Not allowed: this needs the "<permission>" permission. An admin can grant it.

Seats

A person takes a seat when they hold any permission beyond viewing and billing. Billing, Auditor and No workspace role take none, and viewers never do. The Members page counts seats in use.