---
title: "Team members and roles"
description: "Invite people to your team, choose what each person can do with permission presets, limit access to specific banners, and transfer ownership."
url: "https://cookiebeam.com/docs/account/team-and-roles"
lang: "en"
---

# Team members and roles

Invite people to your team, choose what each person can do with permission presets, limit access to specific banners, and transfer ownership.

Everyone who works on your banners is a member of your **team**. Each member has a set of permissions, one level for each area of the dashboard. A **preset** fills in those levels for you.

## Permission areas

| Area | Levels, lowest to highest |
| ---- | ------------------------- |
| **Banners** | None, Read, Edit, Publish, Admin |
| **Discovery & Audit** (scanner and inventory) | None, Read, Run, Configure |
| **Analytics** | None, Read, Write |
| **Compliance** (privacy requests, policies, reports) | None, Read, Write |
| **Team** | None, Read, Manage members, Full |

A higher level includes everything below it.

## Presets

| Preset | Banners | Discovery & Audit | Analytics | Compliance | Team |
| ------ | ------- | ----------------- | --------- | ---------- | ---- |
| **Owner** | Admin | Configure | Write | Write | Full |
| **Admin** | Admin | Configure | Write | Write | Manage members |
| **Editor** | Edit | Run | Read | Write | Read |
| **Publisher** | Publish | Run | Read | Read | Read |
| **Viewer** | Read | Read | Read | Read | None |

Any other combination is shown as **Custom**.

What the presets mean in practice:

- **Publishing** needs Banners at **Publish** or higher. Publisher, Admin and Owner can publish. Editor and Viewer cannot.
- **Creating or deleting a banner** needs Banners at **Admin**.
- **Inviting and removing members** needs Team at **Manage members** or higher.
- **Billing, API keys, SSO, team-wide notification settings and the team session policy** are for the owner only.

Permission checks for publishing and for other sensitive actions are made against the member's current permissions, not the ones they had when they signed in. Removing a permission takes effect on their next action.

## Invite a member

1. Open **Team** in the dashboard sidebar.
2. Under **Invite Team Member**, enter the person's email address.
3. Choose a preset, or set each area yourself.
4. Under **Banner Access**, choose **Access to all banners** or select the banners this person may work on. Members with Banners at Admin always see every banner.
5. Send the invitation.

The invitation is valid for 7 days. You can resend or cancel it from the **Team** page.

Rules that apply to invitations:

- You cannot give anyone more access than you have yourself.
- You cannot invite someone as owner. A team has one owner; see [transfer ownership](#transfer-ownership).
- Pending invitations count toward your plan's member limit. If the team is full, cancel a pending invitation or upgrade.

## Change or remove a member

Members with Team at **Manage members** or higher can change another member's permissions and banner access. Owners and admins can remove members from the **Team** page. A removed member loses access to the team straight away. Their past actions stay in the [audit trail](https://cookiebeam.com/docs/compliance/audit-trail).

## Transfer ownership

Only the current owner can transfer ownership.

1. Open **Team**.
2. Find the member who should become owner and select **Transfer Ownership**.
3. Type `TRANSFER` and confirm with your current password. If you signed in without a password, for example with Google, you may be asked to sign in again first.

Your own role changes to Admin, so you can still manage banners and members. The new owner takes over billing; the team keeps the same Stripe customer, and its email changes to the new owner's.

## Require two-factor authentication

Team admins can require every member to use two-factor authentication. See [Two-factor authentication and sessions](https://cookiebeam.com/docs/account/security#require-two-factor-authentication-for-the-team).

## Work across several teams

You can belong to more than one team, for example when an agency works on several clients' sites. Each team is invited separately and keeps its own billing, banners and permissions.

- Use the team switcher in the dashboard to change teams.
- When you belong to two or more teams, the switcher shows **Overview of all teams**. It lists each team with its banners, unpublished changes, last scan, open action items, accept-all rate and plan usage. It only shows the figures your permissions in that team allow, and it is read-only: open a team to make changes.

There is no parent account that controls other teams, and no combined billing. Each team is billed on its own.

## Related

- [Single sign-on and SCIM](https://cookiebeam.com/docs/account/sso-and-scim)
- [Environments and publishing](https://cookiebeam.com/docs/operations/environments-and-publishing)