> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oasm.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Members

> Manage workspace members, invitations, and permission groups in OASM

The **Members** section (under **Settings → Members**) lets you manage who can access a workspace and what they can do inside it. Its subtitle summarizes the scope: *"Manage members, invitations and permission groups"*.

Membership is workspace-scoped. A platform [user](/users-and-role) becomes a member of a workspace through an invitation, and every member is assigned a permission group that defines their capabilities.

## Key concepts

### Members

Members are the people who work inside a workspace. Each member row shows the **Member** and their **Permission** — for example, a member named **AD Admin** with permission **Owner**, or a member named **DE demo1** with permission **Read only**.

### Invitations

Invitations are how new members join a workspace. A pending invitation grants no access until it is accepted.

### Permission groups

Permission groups bundle a set of permissions under one name. Assigning a group to a member grants exactly the permissions the group contains.

## The Members screen

The screen has three tabs:

<Table>
  | Tab         | Purpose                                                     |
  | ----------- | ----------------------------------------------------------- |
  | Members     | List members, search, change permissions, or remove members |
  | Invitations | View pending invitations, resend, or cancel them            |
  | Permissions | Search permission groups and create new groups              |
</Table>

## Invite a member

<Steps>
  <Step title="Open the Members tab">
    Navigate to **Settings → Members**.
  </Step>

  <Step title="Click Invite member">
    The **Invite member** button opens the invitation form.
  </Step>

  <Step title="Enter the email address(es)">
    Provide one or more email addresses for the people you want to invite.
  </Step>

  <Step title="Choose a permission group">
    Select the permission group the new members should receive.
  </Step>

  <Step title="Send the invitation">
    Submit the form. An invitation is sent to each address; it appears under the **Invitations** tab until accepted.
  </Step>
</Steps>

Once an invitee accepts, they appear in the **Members** tab with the permission group you selected. Use the per-row menu to change a member's permission or remove them at any time.

<Accordion title="Can I resend or cancel an invitation?">
  Yes. Open the **Invitations** tab to see all pending invitations. Each pending invite can be **resent** (for example, if the email was lost) or **cancelled** (to revoke the invite before it is accepted).
</Accordion>

## Manage members

In the **Members** tab, each row has a menu with two actions:

* **Change permission** — re-assign the member to another permission group.
* **Remove** — remove the member from the workspace. Removed members lose access immediately.

## Create a permission group

<Steps>
  <Step title="Open the Permissions tab">
    Navigate to **Settings → Members → Permissions**.
  </Step>

  <Step title="Search or browse">
    Use the **Search permission groups...** box to find existing groups.
  </Step>

  <Step title="Click Create group">
    The **Create group** button opens the group editor.
  </Step>

  <Step title="Name the group and select permissions">
    Give the group a name and choose the permissions it grants.
  </Step>

  <Step title="Save the group">
    Submit the form. The group is now available when inviting members or changing permissions.
  </Step>
</Steps>

## Built-in permission groups

OASM ships with three built-in groups.

<Table>
  | Group            | What members can do                                                                                |
  | ---------------- | -------------------------------------------------------------------------------------------------- |
  | **Owner System** | Everything in the workspace, including managing members and configuration                          |
  | **Admin**        | Manage workspace settings, members and invitations, workflows, permission groups, and scan targets |
  | **Read only**    | View invitations and discovered assets                                                             |
</Table>

In practice, the **Admin** group can view and update workspace information, change workspace configuration, manage the workspace API key, add or remove members, manage invitations, create and modify workflows and permission groups, and view and modify scan targets. The **Read only** group is limited to viewing invitations and discovered assets.

## Best practices

* Start every member with the least privilege they need and escalate only when required.
* Reserve **Owner System** and **Admin** for a small set of trusted members — these groups can delete the workspace and manage its configuration.
* Create dedicated groups for recurring team roles instead of assigning permissions ad hoc.
* Review pending invitations and members regularly; cancel stale invites and remove members who left.
* Keep the workspace **Read only** group for members who only need to monitor results.

## Related

<Card icon="shield-user" title="Users and roles" horizontal href="/users-and-role">
  Understand platform roles such as admin, user, and bot
</Card>

<Card icon="layout-grid" title="Workspace" horizontal href="/workspace">
  Understand the isolated tenant members operate in
</Card>

<Card icon="key" title="API keys" horizontal href="/api-keys">
  Manage the workspace API key for programmatic access
</Card>

<Card icon="scroll-text" title="Audit log" horizontal href="/audit-log">
  Review membership and invitation activity
</Card>