Team & Roles
Workspaces in AXO support multi-user teams with three role tiers. Invite teammates and adjust roles from Admin → Account. Every action in the dashboard checks the caller's role on the active workspace.
Owner
Full access to everything in the workspace, plus the ability to transfer ownership and delete the workspace itself. An account always has at least one owner; demoting the last owner is blocked. Owners can invite, promote, demote, and remove any other member except themselves (use transfer-ownership for that).
Admin
Manages every operational surface: integrations, brand voice, campaigns and briefs, segments, zones, content variants, triggers, site settings, billing methods, and team invites (admins can invite other admins and members; only owners promote to owner). Cannot transfer ownership or delete the workspace.
Member
Day-to-day collaborator. Members can view analytics, segments, profiles, lift reports, optimizer state, and chat with the AXO Assistant. The sensitive write paths – team and billing management, MCP token issuance, extension-driven zone publishing – are role-gated and reject member callers with a 403. Other operational endpoints (content authoring, trigger edits, integration changes) are not currently member-gated server-side, so treat the member tier as "trusted collaborator" rather than "guaranteed read-only" until that enforcement lands.
What admins can do
Owners and admins together cover the full operational surface of the workspace. The most common admin-only actions:
- Integrations: connect, test, archive, and delete integrations (Klaviyo, Braze, Resend, Salesforce, Meta CAPI, Google Enhanced Conversions, webhooks). Secrets are envelope-encrypted at rest and never returned to the dashboard in plaintext.
- Brand & site: upload brand guidelines, configure brand voice, set the site's conversion goal(s), apply a vertical pack, manage site overrides and page-level configs.
- Content & zones: author, edit, publish, and archive variants; create and modify zones; approve or reject AI-proposed zone-healing suggestions.
- Audience: create custom segments with signal-rule predicates; rename or hide system segments; trigger CRM and Salesforce sync; manage profile dedup candidates.
- Triggers & campaigns: create, edit, test-fire, and pause triggers; manage campaigns and briefs; clone trigger templates.
- Optimizer: reset the bandit, force a specific variant allocation for a (segment, zone) pair, clear render errors.
- Team: invite members, change roles (admins can invite other admins; only owners promote to owner), remove members.
- Billing: change plan, update payment method, purchase AI credit packs, view invoices.
- API access: generate MCP tokens for external AI agents and rotate site API keys.
Switching workspaces
If you're a member of multiple workspaces, the account switcher in the dashboard header moves you between them. Your role and permissions are evaluated per-workspace – being an owner of one doesn't grant any access to another. Agencies and organizations get a roll-up view that lists every child workspace you can access.