# Members and roles

Distinguish organization management from project collaboration permissions, and handle member deactivation and ownership transfers correctly.

使用指南 · 模块: organization · 管理人员 · 部署形态：资料未说明 · 已确认产品版本：资料未说明 · 来源：现有文档

An organization role determines which team matters a person can manage; a project role determines what they can do in a particular project. Confirm both layers when assigning permissions to colleagues.

## Organization roles

| Role          | Main capabilities                                                                                                | Deployment                |
| ------------- | ---------------------------------------------------------------------------------------------------------------- | ------------------------- |
| Owner         | Manage the organization, members, and projects; manage plans on Cloud                                            | Cloud, private deployment |
| Admin         | Manage organization members and projects; view Cloud usage, but cannot purchase plans or delete the organization | Cloud, private deployment |
| Member        | Use projects they can access; create projects when allowed by the organization                                   | Cloud, private deployment |
| Guest         | Access only projects they have explicitly joined                                                                 | Cloud only                |
| Billing Admin | Manage plans and view usage; cannot enter projects                                                               | Cloud only                |

Each organization has exactly one Owner. Go to **Profile → Organization → Member management** to view members and direct invitations awaiting acceptance.

The Owner can manage other organization roles. Admins can invite or manage only Members and, on Cloud, Guests. Transferring ownership is a separate action; another Owner cannot be assigned through the regular role dropdown.

On Cloud, Owners, Admins, Members, and Guests occupy member slots; Billing Admins and disabled members do not. Unexpired direct invitations reserve slots, except Billing Admin invitations. Private deployments use the license's global user limit. Disabling an organization member does not delete the account or free a global user slot.

## Project roles

| Role                          | Main capabilities                                                                                 |
| ----------------------------- | ------------------------------------------------------------------------------------------------- |
| Project owner (OWNER)         | One per project; manage the project, members, and access policies, and transfer project ownership |
| Project administrator (ADMIN) | Manage project resources and members, and view project content                                    |
| Project member (MEMBER)       | Ask data questions and use project resources they can access                                      |

A regular organization member's effective project permissions come first from an explicit project role, then from a public project's default role. Without either, they cannot enter. Guests use only explicit roles; Billing Admins cannot become project members. Organization Owner/Admin governance does not grant access to private project content. Cloud system administrators' global operational permissions apply separately.

In **Project settings → Project members**, or project details under **Organization → Project management**, select multiple active organization members and assign project Admin or Member. After removing an explicit membership record, a public project may still allow access through its default role. See [Invite members](https://docs.asktable.com/en/organization/invitations) for steps.

## Disable members

Disabling removes organization and project access while preserving the membership record and historical content. Readmit members through the organization invitation process; reimporting from WeCom or WPS does not automatically restore a disabled membership.

Organization member management handles memberships and organization roles only. It does not change account email addresses, passwords, or system administrator status, or delete global accounts. Those account operations belong to system administrator user management.

## Transfer organization and project ownership

Before leaving an organization, its Owner must transfer ownership to an active Admin or Member through Member management. The former Owner then becomes an Admin. Users linked only to WeCom/WPS without email credentials cannot become organization Owners.

If a member still owns any project, they cannot be directly disabled, leave the organization, have their account deleted, or become a Billing Admin. Transfer each project first. The recipient must be an active Admin or Member who has explicitly joined the project; after transfer, the former owner becomes a project Admin.

## Organization page permissions

| Page                                                           | Owner  | Admin                                           | Billing Admin           |
| -------------------------------------------------------------- | ------ | ----------------------------------------------- | ----------------------- |
| Organization settings                                          | Manage | Manage basic information                        | Cloud plan section only |
| Project management, Member management, Enterprise integrations | Manage | Manage, with member actions constrained by role | None                    |
| Cloud usage                                                    | View   | View                                            | View                    |
| Cloud plan purchase and renewal                                | Act    | View only                                       | Act                     |

Organization management pages are not shown to Members or Guests. Private deployments do not provide Billing Admins, Guests, or the Cloud usage page.