Members and roles

Everyone in a company workspace holds one workspace role: Owner, Admin, or Member. The workspace role decides who administers the workspace. It is separate from the company roles you create under Settings -> Roles & permissions, which describe how your company works and narrow what people can see and use.

What each workspace role can do

• Owner can do everything an admin can. Only an owner can promote someone to owner, change or remove another owner, change data residency, and delete the workspace. A workspace can have several owners. The last owner cannot leave or be demoted, so promote another member to owner first.
• Admin invites people, moves members between Admin and Member, removes members and admins, and manages shared settings such as workspace details, company instructions, knowledge sources, company domains, MCP access, and data sharing. Admins cannot change or remove an owner.
• Member works with CORA, sees the knowledge their company roles allow, and can see the member list and pending invitations. Members can view the data residency and data sharing policies but cannot change them.

A role in one workspace gives no access to any other workspace.

Invite someone

1. Open Settings -> People & access.
2. Enter the person's email address and choose Member or Admin.
3. Send the invitation.

The invitation is private, works only for the email address it was sent to, and expires after 14 days. If the email cannot be delivered, CORA shows a private link you can copy and send yourself. Pending invitations can be revoked from the same page.

Let colleagues join with your company domain

Owners and admins can add a custom email domain under Company domains on the same page.

1. Enter the domain, for example northwind.fi.
2. Publish the DNS TXT record CORA shows, then verify it.
3. Turn on automatic member joining for that domain.

After that, colleagues who sign in with a verified email address at exactly that domain join as members. Subdomains need their own verification, and personal or disposable email providers are not eligible. A domain can be verified by only one workspace. People who join this way always join as Member; promote them separately if they need admin access.

If you remove someone who joined through the domain, they cannot rejoin automatically until an owner or admin restores them under Removed domain access. Domain access history lists recent verification, configuration, join, removal, and restore events.

Leaving a workspace

Any member can leave from their own row in the members list. Leaving removes access until you are invited again.