# Team and roles on Aria Cloud

> Invite people to a workspace, choose their role, the projects and pages they can open, require two-factor, and remove access completely.

Source: https://getaria.cloud/docs/team (updated 1 November 2026)

A workspace has four roles: Owner, Admin, Developer and Viewer. Aria does not charge per team member. Owners and Admins invite people and choose what each person can reach, and Aria checks the role on every call, so a change takes effect at once, for that person's keys too.

## What can each role do?

| Role | What it can do |
|---|---|
| **Owner** | Everything, including security and deleting the workspace. |
| **Admin** | Everything but security and deleting the workspace. |
| **Developer** | Deploys and changes the projects they are given. |
| **Viewer** | Sees the projects they are given. Changes nothing. |

| Can they… | Owner | Admin | Developer | Viewer |
|---|---|---|---|---|
| See projects, domains and activity | Yes | Yes | Their projects | Their projects |
| Deploy, and change variables, domains, `aria.yaml` and data | Yes | Yes | Their projects | No |
| Make MCP keys and use agents | Yes | Yes | Their projects | No |
| Ask Aria AI | Yes | Yes | Yes | Read only |
| Create projects, buy servers and domains | Yes | Yes | No | No |
| Delete projects and destroy servers | Yes | Yes | No | No |
| Change settings, GitHub and access | Yes | Yes | No | No |
| Manage billing | Yes | Yes | No | No |
| Invite people and change roles | Yes | Yes | No | No |
| Connect Aria AI | Yes | Yes | No | No |
| Change security, delete the workspace | Yes | No | No | No |

An Admin never touches an Owner. Owners and Admins open every project.

## How do I invite someone?

1. Open **Team** and choose **Invite people**.
2. Add each person's email, up to 10 at a time, with an optional name.
3. Choose a role.
4. Choose their projects: all, including new ones, all current projects, or a list you pick.
5. Choose **Send invitations**.

They get an email with a link that lasts 7 days and works only for their address. Pending invitations show on the Team page, where you can resend or withdraw one.

## Can I limit which pages someone sees?

Yes. Open a member and go to **Pages they can open**. Switch a page off to keep them out of it. This only takes away from what the role allows. It never adds to it.

## How do I change someone's role or projects?

Open the member. Their panel changes the role and projects, and shows their keys and agents.

## How do I remove someone?

Open the member and choose **Remove access completely**, then type their email. Aria revokes their keys, tokens, signed-in sessions, private-project sign-ins and database logins at once, and tells you what was revoked. Their own account stays.

To leave a workspace yourself, choose **Leave workspace**. An Owner or Admin can invite you again.

## How do I hand over a workspace?

Open a member and choose **Make them the owner**, then type their email. They get everything, and you become an Admin.

## Can I require two-factor sign-in?

Yes. An Owner opens **Settings**, then **Security**, and turns on **Require two-factor for everyone**, after turning it on for themselves. Members without it can look around but change nothing until they turn it on. The Team page shows who has it.

## Who can open a private service?

A service with `access: owner` in `aria.yaml` sits behind Aria's sign-in, and only the workspace's Owners and Admins get through. See the [aria.yaml reference](https://getaria.cloud/docs/aria-yaml).

Next: [Billing, plans and cancelling on Aria](https://getaria.cloud/docs/billing)