Inviting your team and managing roles

Flaxxa workspaces have three default roles: Member, Editor, Admin. Roles are workspace-wide, but per-product permissions can override them.

The three default roles

• Member — read-only by default. Can view conversations, dashboards, reports. Cannot edit settings or install products.
• Editor — write access to product surfaces. Can reply to tickets, send broadcasts, edit templates, run flows. Cannot edit billing or workspace settings.
• Admin — full access. Can install/uninstall products, manage billing, edit team, configure SSO and audit log.

Per-product permission overrides

For finer control, each product surface lets you grant per-product roles. Example: you might want a finance person to see the AI cost ledger (Read) but never run AI calls (no Inference). Inside Flaxxa AI → Settings → Roles, grant them ai.observability.view without ai.inference.use.

The kernel enforces both layers — workspace role AND per-product permission must allow the action.

SSO and SCIM (Pro tier and above)

SAML 2.0 SSO and SCIM 2.0 provisioning are included on Pro. Configure under Settings → Identity. Once SSO is on, Just-In-Time provisioning creates Members on first login; SCIM keeps the team list in sync with your IdP (Okta, Azure AD, Google Workspace, JumpCloud).

Audit log

Every role change, permission grant, and team-member action is captured in the workspace audit log (Settings → Audit). Tamper-evident, exportable to your SIEM via webhook or S3.