Team collaboration

A BrandBanta workspace can have multiple members. You'd add teammates so the marketing team, the brand team, the SEO lead, and an external agency contractor can all see the same numbers and act on the same alerts.

Roles

Role	Can do
Owner	Everything an admin can do + delete the workspace + transfer ownership
Admin	Manage members, billing, API keys, schedules, and all data
Member	Read all data, run scans, edit topics/queries/brands. Can't manage members or billing.

Roles are per-workspace. A user can be an Admin in one workspace and a Member in another — common for agency/contractor setups.

How much can a member spend?

Members can run scans but cannot manage the API keys those scans consume — adding, editing, or removing a workspace key is admin-only. So a member spends the workspace's key without being able to change it.

To keep that bounded, each member has their own scan allowance:

Who	Allowance
Member	A fixed number of scans in that workspace, counted for their lifetime
Owner / Admin	Exempt — they own the key
Scheduled scans	Exempt — no individual to attribute them to

When a member uses theirs up, scans stop with MEMBER_SCAN_CAP_EXHAUSTED. Two ways forward: an admin raises the limit, or the member creates their own workspace and adds their own API key — a member's allowance is per-workspace, and their own workspace is theirs to configure.

This is separate from, and stacks with, the workspace-wide limits: the free-tier caps on the shared key, the per-tier scan quota, and the optional hard budget cap an admin can set in Settings → Cost. The strictest applicable limit governs.

Inviting teammates

Settings → Members → Invite
Enter the email address + select a role
Send the invite

The invitee gets an email with a one-click join link. They sign up (or log in if they already have an account) and the workspace appears in their org switcher.

Invites expire after 7 days. You can revoke pending invites from the same page.

Removing members

Admins and Owners can remove any non-Owner member. The Owner can transfer ownership to another Admin before removing themselves.

Removed members lose access immediately. Their historical actions (scans they ran, topics they created) stay attributed to them for audit purposes — we don't rewrite history when someone leaves.

Multi-workspace UX

If you're a member of multiple workspaces (common for agencies or consultants):

The workspace switcher (top-left of the sidebar) lists all your workspaces
Each workspace has its own URL handle, so bookmarks are workspace-specific
Active workspace is URL-driven — your session also tracks it for routes that don't have a workspace in the URL (like settings)

Per-user notification preferences

Notifications are workspace-scoped but delivery preference is per-user. Two members of the same workspace can:

One person gets in-app + email + Slack
Other person gets only Slack
A third person gets nothing (they only check the dashboard manually)

Configure in Settings → Notifications (under your account, not the workspace settings).

Audit log

Every member-level action is logged to the audit log (append-only audit_event table). Captured events include:

Sign-in, sign-up
Password reset, change, set
Two-factor enable, disable
Email change
Admin actions (impersonate, ban, role-change, delete)
Organization invitation accept, decline
API key add, replace, revoke

Owners can view the audit log under Settings → Security → Audit log (or via the admin panel for workspace-wide visibility).

We deliberately keep the audit log narrow — only security-relevant events. Operational events (scans run, topics edited) are inferrable from the data itself.

Impersonation (admin-only)

Site admins (the platform team, not workspace admins) can impersonate a user via the admin panel for support purposes. When impersonating:

A sticky red banner appears at the top of every authenticated page with a "Stop impersonating" button
All actions during impersonation are logged with both the impersonator and the impersonated user
Session is short-lived (~15 minutes) and requires fresh re-auth

This exists for legitimate customer-support scenarios where the user has explicitly asked us to look at their account. We never impersonate without an authorized request.

What's not on the team-collaboration roadmap yet

Granular permissions — "this user can see topic A but not topic B." All members see all workspace data. Premium use case; on the roadmap behind real customer demand.
Shared annotations on scans — leaving notes on individual scans for the team. Nice-to-have; deferred.
External-facing reports — sharing a read-only insights dashboard with a customer or executive without giving them a seat. On the roadmap for the Team tier.