> ## Documentation Index
> Fetch the complete documentation index at: https://docs.komodor.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Accounts & members

> The workspace as an isolation boundary, belonging to several at once, and how to invite, suspend, and restore the people in one.

A workspace is your team's space: agents, runs, integrations, credentials, keys, and members all
belong to one, and data is isolated to it. This page explains what that boundary means in practice,
how belonging to more than one workspace works, and how you manage the people in yours.

## The workspace boundary

Everything is owned by exactly one workspace, and you always act in exactly one at a time. An agent,
run, credential, knowledge base, or channel in one workspace is never visible from another — see
[Agent isolation & tenancy](/security-and-governance/architecture-considerations/agent-isolation-tenancy)
for how that is kept.

Friendly names are scoped to the workspace rather than shared globally, so two teams can each have
an agent called `triage` or a credential called `github` with no collision between them and no way
to detect each other's.

## Belonging to more than one

You can be a member of several workspaces — because you work across teams, or because more than one
trusts your verified email domain. When you belong to more than one, a **workspace switcher** lists
them; picking one changes which workspace you are viewing and acting in, and the switch is recorded
in the [audit log](/security-and-governance/controls/audit-log). With a single membership the
switcher is hidden.

## Managing members

**Settings → Members** lists everyone in the workspace.

### Inviting

Invite by email. The membership is created immediately and activates on that person's first sign-in
— there is no acceptance step. You can give an invitation a display name so the row is recognizable
before they arrive, and assign roles as part of it.

### Suspending and restoring

<Steps>
  <Step title="Suspend to revoke access">
    Suspension takes effect immediately: live browser sessions stop working on their next request,
    and any API keys bound to that person stop authenticating.
  </Step>

  <Step title="A suspension is never undone silently">
    Even if the person's email domain is still trusted by the workspace, signing in again does not
    reactivate them. Only an explicit restore does.
  </Step>

  <Step title="History is preserved">
    Suspending removes access, not work: runs and other records stay attributed to them.
  </Step>
</Steps>

### Roles and attributes

Each member holds one or more roles, which decide which policies — and therefore which capabilities
— they receive. Roles and **attributes** are both columns on the Members screen: an attribute is a
key–value pair like `team = payments`, and label-scoped grants match against it, so one grant can
give everybody access to their own team's resources. Editing attributes is itself a governed
capability, so it stays with administrators by default.

See [Roles & permissions](/security-and-governance/identity-and-access/roles-permissions) for the
full model.

## Next steps

<CardGroup cols={2}>
  <Card title="Roles & permissions" href="/security-and-governance/identity-and-access/roles-permissions">
    Built-in roles, custom roles, and how a grant is scoped.
  </Card>

  <Card title="Service accounts" href="/security-and-governance/identity-and-access/service-accounts">
    The identity automation should use instead of a person's.
  </Card>

  <Card title="Access explorer" href="/security-and-governance/identity-and-access/access-explorer">
    Check what a member can do before and after a change.
  </Card>

  <Card title="Audit log" href="/security-and-governance/controls/audit-log">
    Invitations, suspensions, and restorations are all recorded.
  </Card>
</CardGroup>


## Related topics

- [Signing in](/security-and-governance/identity-and-access/signing-in.md)
- [Admin Console](/security-and-governance/controls/admin-console.md)
- [Connect coding agents](/developer-tools/connect-coding-agents.md)
- [Concepts & glossary](/get-started/concepts.md)
- [API keys](/security-and-governance/identity-and-access/api-keys.md)