Roles and access — Help center

Everyone in a company has one role, and the role decides what they can see and change. This page explains the four built-in roles, custom roles that restrict features further, how invitations work from both sides, and where every change to the team is recorded. The day-to-day screens are described in Team.

The four roles

Role	In one line
Owner	Runs the company: everything an administrator can do, plus managing other owners and administrators
Admin	Sets the workspace up and manages members and viewers
Member	Does the daily work: contacts, deals, tasks, appointments, conversations
Viewer	Can open and read, but not change anything

A person can belong to several companies with a different role in each. The role in one company gives nothing in another.

What each role may do

Action	Owner	Admin	Member	Viewer
Open the company and read its contacts, deals, tasks and reports	Yes	Yes	Yes	Yes
Add and edit contacts, deals, tasks, appointments and notes, and reply to customers	Yes	Yes	Yes	No
Set up the workspace: pipelines and stages, custom fields, segments, business templates, products, channels, website forms, store connections, campaigns, automations, booking page, online payments, tracking, API keys and webhooks	Yes	Yes	No	No
Import, merge and export contacts, and erase a contact's data	Yes	Yes	No	No
See the team performance report and the audit log	Yes	Yes	No	No
See the setup checklist and the plan card on Home	Yes	Yes	No	No
Change the workspace's Appearance	Yes	Yes	No	No
Invite people and manage memberships	All roles	Members and viewers only	No	No
Create and assign custom roles	Yes	Yes	No	No
Buy or renew the plan	Yes	Yes	No	No
Grant Temporary support access to the platform team	Yes	No	No	No
Leave the company	If another active owner remains	Yes	Yes	Yes

Some features are also limited by your plan, whatever the role. See Plans and billing. If your company uses branches, a branch can hide or lock some fields too: see Branches.

Rules that protect the team

Nobody can change their own role, or suspend or remove themselves. To end your own membership, use Leave organization on Team.
Administrators cannot touch owners or other administrators, and cannot give anyone those roles. They see Protected role next to such people.
A company always keeps at least one active owner. The last active owner cannot be given another role, suspended, removed, or leave. To hand over a company, first make someone else an owner, then leave or change your own role from their account.
A suspended member keeps their place but cannot open the company until an owner or administrator selects Restore access. A suspended owner does not count as an active owner.

Invite someone

Owners and administrators invite people from Team.

Open Team in the sidebar.
Go to Invite someone to your team.
Enter the person's Email address and choose their Role in this organization. Administrators can only offer Member or Viewer.
Select Create invitation link.
Copy the Invitation link shown under Your invitation link is ready, and send it to the person yourself, by email or chat.

Rutba CRM does not email the invitation for you, and the link is shown only once, right after you create it. If you lose it, select New link next to the invitation.

What to know about invitation links

A link works for 7 days. Access begins only when the person accepts.
A link only works for the email address it was made for.
Selecting New link for the same email replaces the previous link, which stops working.
Revoke cancels a pending invitation.
You cannot invite yourself, or someone who is already a member, even a suspended one. To bring back a suspended member, use Restore access instead.
Organization invitations lists every invitation with its status: Pending, Accepted, Revoked or Expired.

Accept an invitation

Open the invitation link you received.
If you have no account yet, the Create your account page opens with the invited email already filled in. Enter your Full name, a password of at least 12 characters with upper and lower case, a number and a symbol, and select Create account.
If you already have an account, sign in with the invited email.
Confirm your email address if you have not already. Open the link we send you; it works for one hour.
Review the company and the role you are offered, then select Accept invitation & join.

You land on the company's Home with "Invitation accepted. Welcome to the team." If the company has its own address, you are taken to that address instead, and you sign in once more on it. To decline, select Continue without accepting: nothing is created, and the invitation itself stays as it is.

Custom roles

A custom role takes features away from some people, on top of their role. It never gives anyone more than their role already allows. Custom roles are available when your plan includes Custom roles, and owners and administrators manage them. The steps are in Team.

A custom role is a name and a list of features under This role cannot use, for example Email campaigns, Exports or API access. At least one feature must be chosen.
A company can have up to 20 custom roles, and each person can have one.
The owner can never be given a custom role.
When someone opens a feature their custom role blocks, they see Not in your plan. The sidebar still shows the entry.
If the custom role blocks API access, API keys that person created stop working too. If it blocks Campaign returns, their keys can no longer send ad spend.
A restriction stays in force even if your plan later drops Custom roles, so nothing is quietly lifted.

Custom roles restrict features only. They cannot limit someone to certain records, such as "only my own customers", and they do not affect the core areas like contacts, deals and tasks.

The history of changes

Owners and administrators can see who changed what, and when.

Membership history on Team lists every membership change: Member added, Role changed, Membership suspended, Membership restored, Membership removed and Left organization, with who did it, the role and status before and after, and the time.
Recent invitation changes lists Invitation issued, Invitation reissued, Invitation revoked and Invitation accepted, with who did it and the role offered.
The Audit log, available when your plan includes Audit log, records sensitive actions on your data, such as exporting contacts, downloading or erasing a contact's data, merging contacts, saving store keys or voiding a payment. Open it from Contacts.

These records are added to, never edited, and nothing in them shows emails, phone numbers or invitation links.

Troubleshooting

"This invitation is for another email address." You are signed in with a different account. Sign out and sign in with the invited email, or ask for a new invitation.
"This invitation is unavailable." It expired, was revoked, or was replaced by a newer link, or the person who sent it is no longer allowed to invite with that role, for example because they are no longer an owner or administrator. Ask for a new one.
"Unable to accept the invitation." The invitation changed after you opened it, for example it was revoked, or you are already a member. Open the invitation link again to see its state.
"You have reached the limit of your package: Users (…)" The company already has as many active members as its plan allows. An owner or administrator has to free a place or move to a larger plan, then you can accept.
I can't see the invite form. Only owners and administrators manage the team. Members and viewers see Your place in the team instead.