Workspaces and roles
A workspace is where a team keeps its projects, runs, files and members. Workspaces are fully separate: people outside a workspace cannot see it, and cannot even learn that it exists.
You can belong to several workspaces. The person who creates a workspace becomes its owner.
| Action | Owner | Admin | Member | Viewer |
|---|---|---|---|---|
| See the workspace, its sessions, projects, runs, files, traces and members | ✓ | ✓ | ✓ | ✓ |
| Download files | ✓ | ✓ | ✓ | ✓ |
| Send messages, start sessions, plans and runs that use credits | ✓ | ✓ | ✓ | — |
| Upload and delete files | ✓ | ✓ | ✓ | — |
| Approve an environment, a push, a scenario case or a lesson | ✓ | ✓ | ✓ | — |
| Approve a plan, and how scenario cases run (the runner) | ✓ | ✓ | — | — |
| See and change held-out cases | ✓ | ✓ | — | — |
| Connect GitHub accounts | ✓ | ✓ | — | — |
| Make and revoke ingest keys; link a session to an application | ✓ | ✓ | — | — |
| Attach online evaluators; activate automations | ✓ | ✓ | — | — |
| Add model keys (bring your own key) | ✓ | ✓ | — | — |
| Set members’ budgets; approve more credits for a task | ✓ | ✓ | — | — |
| Export the workspace; see Data and Access history | ✓ | ✓ | — | — |
| Invite people, change roles, remove members | ✓ | ✓ | — | — |
| Transfer ownership | ✓ | — | — | — |
A coding tool connected over MCP acts with your role, and never approves anything.
Invitations can grant the admin, member or viewer role. Owner is not offered in invitations.
Invitations
Section titled “Invitations”- An invitation is sent by email and is valid for 7 days.
- It can be used once.
- The person accepting must be signed in with the same email address the invitation was sent to, and that address must be verified.
- If a removed member is invited again, they rejoin with the new role.
Requests from WeHarness
Section titled “Requests from WeHarness”WeHarness staff never add anyone to your workspace themselves. If WeHarness suggests inviting someone, for example a colleague during a pilot, the request appears for the workspace’s owner under Settings → Members, with the email address, the role (admin, member or viewer) and the reason. Nobody joins unless the owner approves it in the app, and then the person still accepts the invitation themselves. Approving and declining are listed in Access history. A request the owner does not answer expires.
Transferring ownership
Section titled “Transferring ownership”The owner can hand the workspace to another active member in Settings → Members, in the web app. The new owner takes over, and the previous owner becomes an admin.
Removing access
Section titled “Removing access”When an owner or admin removes a member, access ends immediately. The member’s next request to the workspace fails, including any live event stream or MCP call.
What “not found” means
Section titled “What “not found” means”If you open a workspace or project you do not have access to, WeHarness answers not found rather than forbidden. This is deliberate: it does not reveal whether the workspace exists. If you are a member but your role does not allow an action, you see a clear message saying so.