> ## Documentation Index
> Fetch the complete documentation index at: https://docs.foggyhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Teams and access

> Roles, invites, and workspace setup for your Foggy team.

All data is scoped to a **workspace** (also called a project). Each user has one of two roles.

## Roles

| Role       | Can do                                                                                                                                            |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Owner**  | Everything: invite members, add and remove connectors, edit the knowledge base, manage automations, rotate the license key, delete the workspace. |
| **Member** | Investigate: run chats, read results, read the knowledge base and automations. Cannot change configuration.                                       |

The first user on a self-hosted install becomes the workspace **Owner**. On cloud, the user who creates a workspace is the Owner.

## Invite teammates

1. Go to **Settings** → **Team**.
2. Enter the teammate's email and pick their role.
3. Foggy sends an invite link. Invites expire after 7 days; re-send from the same page if it times out.

Invitees set a password or authenticate with SSO and land directly in the workspace.

## Workspaces

Connectors, knowledge base, automations, and chat history are scoped to the workspace — nothing crosses over.

* **Cloud:** you can create multiple workspaces and switch between them from the workspace picker in the sidebar.
* **Self-hosted:** a single workspace per install. If you need hard data isolation between environments (e.g. `prod` vs `staging`), run two Foggy installs.

## First-login setup (self-hosted)

On first open, enter the email the founder-team recorded when issuing your license, set a password, and you're in as the workspace Owner. This email gate runs once — subsequent logins use your chosen credentials.

## Troubleshooting

* **"Invite already used" on the invitee's click** — the invite was accepted from a different browser, or it has been claimed. Check the Team page to see if the user is already a member.
* **Invitee sees the wrong workspace** — the invite is workspace-scoped; double-check you invited them from the workspace you intended. Cloud users can switch workspaces from the sidebar picker.
* **Cannot demote the last owner** — every workspace must have at least one Owner. Invite a second Owner first, then demote.

## Next steps

<CardGroup cols={2}>
  <Card title="Security" icon="shield-halved" href="/platform/security">
    Data isolation, encryption, and the LLM data flow.
  </Card>

  <Card title="Kubernetes RBAC" icon="lock" href="/self-hosted/rbac">
    How Foggy accesses your cluster. Separate from workspace roles.
  </Card>
</CardGroup>