Run
Team and roles on Aria Cloud
Invite people to a workspace, choose their role, the projects and pages they can open, require two-factor, and remove access completely.
In this page
A workspace has four roles: Owner, Admin, Developer and Viewer. Aria does not charge per team member. Owners and Admins invite people and choose what each person can reach, and Aria checks the role on every call, so a change takes effect at once, for that person’s keys too.
What can each role do?
| Role | What it can do |
|---|---|
| Owner | Everything, including security and deleting the workspace. |
| Admin | Everything but security and deleting the workspace. |
| Developer | Deploys and changes the projects they are given. |
| Viewer | Sees the projects they are given. Changes nothing. |
| Can they… | Owner | Admin | Developer | Viewer |
|---|---|---|---|---|
| See projects, domains and activity | Yes | Yes | Their projects | Their projects |
Deploy, and change variables, domains, aria.yaml and data |
Yes | Yes | Their projects | No |
| Make MCP keys and use agents | Yes | Yes | Their projects | No |
| Ask Aria AI | Yes | Yes | Yes | Read only |
| Create projects, buy servers and domains | Yes | Yes | No | No |
| Delete projects and destroy servers | Yes | Yes | No | No |
| Change settings, GitHub and access | Yes | Yes | No | No |
| Manage billing | Yes | Yes | No | No |
| Invite people and change roles | Yes | Yes | No | No |
| Connect Aria AI | Yes | Yes | No | No |
| Change security, delete the workspace | Yes | No | No | No |
An Admin never touches an Owner. Owners and Admins open every project.
How do I invite someone?
- Open Team and choose Invite people.
- Add each person’s email, up to 10 at a time, with an optional name.
- Choose a role.
- Choose their projects: all, including new ones, all current projects, or a list you pick.
- Choose Send invitations.
They get an email with a link that lasts 7 days and works only for their address. Pending invitations show on the Team page, where you can resend or withdraw one.
Can I limit which pages someone sees?
Yes. Open a member and go to Pages they can open. Switch a page off to keep them out of it. This only takes away from what the role allows. It never adds to it.
How do I change someone’s role or projects?
Open the member. Their panel changes the role and projects, and shows their keys and agents.
How do I remove someone?
Open the member and choose Remove access completely, then type their email. Aria revokes their keys, tokens, signed-in sessions, private-project sign-ins and database logins at once, and tells you what was revoked. Their own account stays.
To leave a workspace yourself, choose Leave workspace. An Owner or Admin can invite you again.
How do I hand over a workspace?
Open a member and choose Make them the owner, then type their email. They get everything, and you become an Admin.
Can I require two-factor sign-in?
Yes. An Owner opens Settings, then Security, and turns on Require two-factor for everyone, after turning it on for themselves. Members without it can look around but change nothing until they turn it on. The Team page shows who has it.
Who can open a private service?
A service with access: owner in aria.yaml sits behind Aria’s sign-in, and only the workspace’s Owners and Admins get through. See the aria.yaml reference.