> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.moyoinnovations.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.moyoinnovations.com/_mcp/server.

# Team & Permissions

> Invite teammates and control what each one can do.

Every teammate you invite gets exactly one **permission profile**, which
governs what they can do across every module your organization has enabled.
Manage this from **Settings → Team**.

## Built-in profiles

| Profile              | What it can do                                                                                                             |
| -------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| **Owner**            | Everything, including billing and transferring ownership. Exactly one per organization.                                    |
| **Admin**            | Manage users, profiles, and settings; full data access. Can't transfer ownership or manage the organization's own billing. |
| **Manager**          | Full operate + approve rights within their part of the org hierarchy — approving expenses, managing their team's records.  |
| **Member**           | Works their own records, plus whatever's explicitly shared with them.                                                      |
| **Viewer**           | Read-only across every enabled module — no creates, edits, or deletes anywhere.                                            |
| **Billing User**     | Full access to Billing; read-only everywhere else.                                                                         |
| **Expense Approver** | Can submit and approve expenses; read-only everywhere else.                                                                |

Profiles are immutable system defaults — you assign one per person rather
than building custom permission sets from scratch.

## Inviting a teammate

Add them by email under **Settings → Team → Invite**, and assign a profile
at the same time. You can change a teammate's profile later from the same
screen.

## Under the hood: permission keys

Every check ultimately resolves to a `module:resource:action` key — e.g.
`crm:lead:create`, `billing:invoice:export`. You'll see these in
[error responses](/getting-started/errors) when a request is blocked
(`"required": "crm:lead:view"`), which is the fastest way to tell a
teammate exactly what to ask for.

The `core` module covers everything that isn't tied to one product — members,
roles, workspace settings, branding, audit logs, import/export jobs, SSO, and
items (`core:item:view`, `core:item:create`, `core:item:delete`).

> **Note**
>
> Members can view `core` resources but not create or edit them — writes to
> workspace-level configuration are reserved for Manager and above. That is why
> the Member profile can view items without being able to add them.

## Related

* [Core Concepts](/getting-started/concepts) — how module entitlement and
  permission checks combine on every request
* [Plans & Modules](/guides/plans-modules) — which modules exist for a
  profile to have access to in the first place