Archive workspaces use flat permissions. There are no admin, editor, or viewer roles — every member who has access to a workspace can take every action inside it.
What Every Workspace Member Can Do
Anyone with access to a workspace can:
Connect, disconnect, and configure social profiles, hashtags, and mentions
Create, edit, and delete campaigns, collections, views, and labels
Request usage rights and reply to creators on the workspace's behalf
Generate, rotate, and revoke API tokens (see Generating an API Token)
Invite or remove other members of the workspace
View and download all content captured by the workspace
There is no permission setting that limits a member to read-only access or restricts which areas they can use.
Read-only access exists in one place only: an AI agent connected over the MCP server, where write access is a scope you grant when connecting it — see Using the Archive MCP Server.
Why API Tokens Are Workspace-Based
Because Archive does not differentiate between user roles, API tokens are scoped to the workspace, not to the individual member who created them. Any token generated from a workspace has the same level of access as any member of that workspace.
Practical implications:
Tokens are not personal credentials. Treat each token as a workspace-level secret — anyone with the token can act on the workspace.
Rotate when a member leaves. Since tokens aren't tied to a person, removing someone from the workspace does not invalidate tokens they generated. Rotate any tokens you suspect they had access to.
Agent connections are the exception — they are per person. When someone connects an AI agent with browser sign-in, that connection belongs to them, not to the workspace. Archive re-checks their workspace access on every request, so removing them from the workspace cuts their agent off immediately. You can revoke any connection under Settings → API → Authorized connections — and revoking it drops that agent from every workspace it could reach, not just this one.
⚠️ Removing a member does not rotate your API token. Their own access ends immediately, and so does any AI agent they connected. But a token they generated keeps working, because it belongs to the workspace — rotate any token they had access to.
Managing Workspace Members
Access is granted at the workspace level: a member either has access to the workspace or doesn't. To control who can see and act on a workspace, manage the member list under Settings → Workspace: Your teammates lists everyone with access, with Invite new teammate to add someone and Remove to take access away. There are no per-area permissions to configure.
If you need finer-grained controls for your use case, reach out to your Customer Success Manager (CSM) so we can capture the requirement.