# Roles and Permissions in Rudder Lookout


{{< customreadfile "/includes/lookout/beta-callout.md" >}}

Access within a Lookout workspace follows clear roles. Every member can chat, build dashboards, and read and write knowledge, while configuration and connected accounts are reserved for admins and the owner. Unregistered users can be given read-only guest access.

## Workspace roles

Membership comes with one of three primary roles:

{{< info >}}
These roles and boundaries are enforced by Lookout, not just hidden in the interface.
{{< /info >}}

| Role | <div style="width: 250px;">What they can do</div> | <div style="width: 250px;">Notes</div> |
|------|--------|-------|
| **Member** | Use the chat agent, build and activate [audiences]({{< ref "lookout/audiences/_index.md" >}}), build and view dashboards, and read and write [Context Hub]({{< ref "lookout/working-with-lookout/context-hub.md" >}}) docs and notes | The everyday working role — they get the full conversational product but can't change team configuration or connected accounts |
| **Admin** | Everything a member can do, plus edit settings, connect warehouses and data sources, manage the RudderStack and Slack connections, create invites, and add, remove, promote, or demote members | Admins are peers — any admin can change another admin's role. The owner is the only exception — they can't be demoted or removed |
| **Owner** | Everything an admin can do, plus rename and delete the workspace | Every workspace has exactly one owner — the person who created it |

### Guest access (read-only)

Beyond the three member roles, Lookout also supports **guest** access for people who are not registered workspace members. Guests can **read and ask**, but never **edit or change** — they can't edit dashboards, write to connected systems, or act on the team's behalf. 

Guest access is available in two contexts:

#### 1. Slack

A Slack user who hasn't yet linked a Lookout account can ask **read-only** questions in bound channels and DMs. Guest access is enabled by default. However, an admin can disable it via the **Allow guest access in Slack** toggle under **Settings** > **Integrations**. 

Once a user links their account (with `/lookout connect`), they act as their full workspace identity. See [Slack]({{< ref "lookout/integrations/slack.md" >}}) for more information.

#### 2. Public links

Anyone with access to a public [dashboard link]({{< ref "lookout/working-with-lookout/dashboards.md" >}}) can view it read-only.

## Membership and trust

A member and an admin share the same connected systems for the team. For example, the team's RudderStack connection is configured once for the whole workspace, so anyone who can drive the chat agent works through the same connection. 

Treat workspace membership itself as the meaningful access decision — roles separate configuration duties from everyday use. See [Security and Data Handling]({{< ref "lookout/security.md" >}}) for more information.

## Add and manage members

Owners and admins can manage members from **Settings** > **Members**, and add new people by [inviting them by email]({{< ref "lookout/workspaces/inviting-teammates.md" >}}).

<br />