# Concept: Member & roles

A **member** is a user's seat in one account, and it carries a **role**: `owner`, `admin`, or `member`. Roles are inclusive — owner can do everything admin can, admin everything member can. Members read; admins also manage products, credentials, destinations and invites; owners also rename the account and change roles. Nobody can grant a role above their own, an admin cannot mint an owner, and the last owner cannot be removed or demoted — an account without an owner would be unmanageable.

People join by **invite**: an owner or admin sends one to an email address with a role attached, and accepting the link creates the membership. A pending invite can be revoked; a removed member can be re-invited.

One thing a role is **not**: the platform-operator (`app admin`) axis. That is a property of the user, grants nothing inside any account, and is managed at /system — the two never mix.

Related: [Account](/concepts/account?detail=full) · [API token](/concepts/api_token?detail=full)