Workspace, members and roles
How workspaces, teams and members fit together, what each role may do, and how to invite and remove people.
A workspace is your company’s home in kanman. It holds your teams, your members, your integrations and your audit log. Most companies need one workspace.
How the pieces fit
| Level | What it is | Example |
|---|---|---|
| Workspace | Your organisation in kanman: members, integrations, billing, audit log | acme |
| Team | One AI team, bound to one tracker project and one or more repositories, with its own policy and budget | payments-team |
| Story | One piece of work, mirrored from your tracker, with acceptance criteria | PAY-142 |
| Run | kanman working on one story, with attempts, gates and an evidence pack | run-7f3k |
The workspace appears in every app URL, for example app.kanman.ai/acme/teams/payments-team.
There is one kanman per workspace. It works in all of your teams and appears next to your members in activity, decisions and the audit log.
Roles
| Role | Can do |
|---|---|
| Owner | Everything an admin can do, plus deleting teams and the workspace. |
| Admin | Create teams, change team policies, budgets and settings, connect integrations, manage members, the provider key, API tokens, webhooks, runners and billing, open and export the audit log. |
| Member | Set up teams of their own and work in all teams: submit requirements, approve or reject drafted stories, answer decisions, stop and retry runs, pin or retire conventions. Team settings are shown read-only. |
| Viewer | Read-only access. |
Answering decisions is deliberately open to members: the person closest to the work should be able to approve a plan or answer a question. Every answer is recorded in the audit log with the member’s name.
Members and viewers see workspace and team settings as they are, with one line at the top saying that only owners and admins can change them; the controls are shown but cannot be used. Their own connections (code hosts, Slack, Claude Code) and conventions stay open to them.
The Audit log and Members entries in the workspace menu (the workspace name at the top left) are shown to owners and admins only.
Workspace settings
Open Workspace settings from the workspace menu (click “workspace / team” at the top left). They live under /<workspace>/settings/<page>: ten pages, grouped in the list on the left (on phones, the page button opens the list as a sheet):
| Group | Page | Path | What you manage |
|---|---|---|---|
| Workspace | General | /settings/general |
The workspace’s name and address, branding (logo and accent colour) and, for the owner, the danger zone for deleting the workspace |
| Workspace | Members | /settings/members |
The people in the workspace, their roles, invitations and, for the owner, transferring ownership |
| Workspace | Plan and usage | /settings/plan |
Each AI team’s plan and how many of its runs are in use, invoices, see Plans and billing |
| AI and runs | Model access | /settings/models |
What new teams use for model access, and your own provider key, see What model providers see |
| AI and runs | Runs and runners | /settings/runs |
Where runs execute (kanman Cloud or your own runners), your runners and Stop all runs for emergencies, see Run the self-hosted runner and Stopping all runs |
| AI and runs | Secrets | /settings/secrets |
Secrets runs may use |
| Connections | Connections | /settings/connections |
Code hosts, trackers, chat tools and wikis, see Connections |
| Connections | Webhooks | /settings/webhooks |
Outgoing webhooks, see Webhook events |
| Security | Single sign-on | /settings/sso |
Single sign-on in four steps, see Single sign-on; sign-on events are in the audit log |
| Security | Audit | /settings/audit |
How long audit entries are kept, with a link to the audit log, see Retention and deletion |
Which repositories a team may change, its Slack channel and its other rules are set per team in Team settings. API tokens are personal: they are in Your settings > API tokens, see Authentication.
All paths start with your workspace, for example app.kanman.ai/acme/settings/members. Older links keep working and take you to the page that now holds the setting: Billing opens Plan and usage, Runners opens Runs and runners, and Code hosts, Trackers and Chat open the matching card on Connections. Press Ctrl+, (Cmd+, on Mac) to search every setting by name.
Most settings save as soon as you change them: Saved appears briefly next to them, and Undo in the message at the bottom brings back the previous value for a few seconds. Branding and single sign-on keep one explicit button, because you usually change several things at once there.
General
Workspace settings > General (/<workspace>/settings/general) holds what identifies the workspace:
- Name: the name everyone sees in the workspace menu. It saves when you change it.
- Address: the part of every app link that names the workspace, for example
acmeinapp.kanman.ai/acme. It is shown as text with a Copy button and cannot be changed. - Branding: your logo and colour, see Workspace branding.
- Danger zone: deleting the workspace. Only the owner sees it, see Deleting a workspace.
A team’s wallpaper is set in the team’s own settings. To give teams without a look of their own the same wallpaper, make one team’s look the workspace default on its Settings > Team page, see Personalize your team.
Workspace branding
Owners and admins can give a workspace your company’s logo and colour. Everyone in the workspace then sees your logo in the top bar instead of the kanman mark, and your colour instead of kanman yellow on the main button of each screen, on selected choices, links, progress and focus outlines. Other members see the branding in Workspace settings > General but cannot change it.
Add your logo
- Open Workspace settings > General (
/<workspace>/settings/general) and find Branding. - Under Logo, choose Upload logo and pick a PNG, WebP, JPEG or SVG file of up to 512 KB.
- Optional: open Different logo on dark backgrounds and upload a version for the dark theme, for example a white or light version of your logo. Without it, the same logo is shown in both themes.
- Choose Apply branding.
The logo is shown 28 pixels high. A square logo appears next to the workspace name; a wide logo (a wordmark) stands on its own. kanman stores a small copy of the image (at most 512 pixels on its longest side). SVG files are converted to an image when you upload them; files with scripts or links to other files are refused, so export your logo as a plain SVG or as PNG if that happens.
Choose your accent colour
Under Accent colour, pick one of the suggested colours, enter your own as a hex value (for example #2563EB) or use the colour picker. While you choose, the whole app shows the colour as a preview, and the two preview bars show it in the light and the dark theme. Nothing changes for others until you choose Apply branding; if you leave the page without applying it, the current colour stays.
Readable in light and dark
kanman keeps text readable whatever colour you pick:
- Labels on buttons in your colour are dark or light, whichever contrasts more.
- Links and highlighted text in your colour are darkened on light pages and lightened on dark pages until they meet the WCAG 2.2 AA contrast level. If you turned on more contrast in Look and feel or in your operating system, they meet the stronger 7:1 level.
- If a colour sits so close to the middle that neither a dark nor a light label is readable on it, buttons use a slightly lighter or darker shade of it.
The picker tells you when this happens, and also when buttons in your colour would barely stand out from the page (for example a very pale yellow in the light theme). Windows contrast themes keep using the system colours.
Back to the kanman look
Choose Reset to kanman defaults and then Apply branding. The kanman mark and kanman yellow come back for everyone. Every change to the branding is recorded in the audit log as “Branding changed”.
Inviting members
Owners and admins can invite anyone by email, several people at once. Nobody joins until they say yes: the invitation waits for them, and you can see it, send it again or withdraw it.
- Open Workspace settings > Members, or ask kanman “Show me the members”.
- Click Invite member. A panel opens.
- Under Email addresses, type or paste one or more addresses. Separate them with commas, spaces or new lines, so you can paste a list straight from an email or a spreadsheet. Anything that is not an email address is marked before you send.
- Choose the role they join with: Admin, Member or Viewer. Each card says what the role may do.
- Optional: under Follows these teams, pick the teams they should follow from their first day.
- Optional: Add a note or change the email’s language lets you write a personal note (it appears in the email and on the page they join from) and choose the language of the email: English, Deutsch, Español or Français. It starts in your own language.
- Remind them once after 3 days is on: if they have not joined by then, they get one reminder. Switch it off if you would rather not.
- Click Send invite (or Send 3 invites, for example).
The panel then shows the outcome for each address. Each person gets an email from you, sent by kanman: it says who invites them, to which workspace, their role in plain words, the teams they will follow and your note, with one button to accept. Replies go to you. The invitation is valid for 14 days.
If the email could not be sent, the panel says so and offers the link to copy, so you can send it another way, for example in a chat message. Someone who is already a member is told so. Members are not billed: kanman is billed per AI team.
If the workspace has no room for another person on its current plans, the panel says so and links to Plan and usage.
From 12 people on, a filter above the list finds people by name or email.
Invite from the conversation
You can also tell kanman: “Invite [email protected] and [email protected] as admins” (or “Lade [email protected] als Mitglied ein”). kanman opens Members with the invite panel already filled in: the addresses and the role you named. Check it, add teams or a note if you like, and press Send invite. Nothing is sent before you do. If you only wrote a name (“Invite Anna”), the panel asks for her address. Only owners and admins can invite; anyone else is told who can.
Invitations waiting to join
Open invitations are listed above the people under Waiting to join, with the role, the teams, when the email was sent and when the invitation ends. A chip says when something needs you: Expired, Email not delivered, or Asks for a new invitation (the person opened an expired link and asked you for a new one; you also get a notification).
Open the ⋯ menu on an invitation to:
- Send again: a new email with a new link and 14 more days. The earlier link stops working and says that a newer invitation replaced it.
- Change role and teams: what they join with. The link stays the same.
- Copy link: a new link to share another way. The emailed link keeps working.
- Withdraw: the invitation leaves the list, and Undo in the message brings it back for a few seconds. After that, the link says that you withdrew the invitation.
When someone joins, they appear in the people list with the role you chose, and the invitation is gone. kanman tells you with one line in your General conversation, for example “Anna joined VIER as an admin and follows Integrations.” It is a quiet note, not a notification on your phone. What the invited person sees is described in You were invited.
Changing a role
- Open Workspace settings > Members.
- On the person’s row, choose the new role: Admin, Member or Viewer.
The new role applies at once, and a message offers Undo for a few seconds. Taking someone’s admin rights away, your own included, asks first and says what they can no longer change. The owner’s role cannot be changed here; see Transferring ownership.
Removing a member
- Open Workspace settings > Members.
- Open the ⋯ menu on the person’s row and choose Remove from workspace.
- Confirm with Remove.
The member loses access immediately. Their past approvals and answers stay in the audit log with their name.
Transferring ownership
Only the owner can hand the workspace over. It is in the danger zone at the bottom of Members, which only the owner sees.
- Open Workspace settings > Members and scroll to the danger zone.
- Under Transfer ownership, choose the new owner. Any person in the workspace can be chosen.
- Type the workspace’s name and click Transfer ownership.
The person becomes the owner right away, and you stay in the workspace as an admin. If they were a member or a viewer, they become an admin as part of the transfer. From then on, the new owner manages billing, can delete teams and the workspace, and can hand the workspace on. You both get a notification in kanman and an email, and the transfer is recorded in the audit log.
Single sign-on
Owners and admins set up single sign-on in Workspace settings > Single sign-on (/<workspace>/settings/sso). Single sign-on is part of Enterprise, see Plans and billing. The page leads you through four steps, one below the other:
- Provider: your identity provider and how it signs people in. Attributes and roles and kanman’s details for your identity provider (the values you enter at your identity provider) are in folds below it.
- Domains: the email domains that sign in through your identity provider.
- Sign-in test: kanman checks the saved setup against your identity provider.
- Turn on: switch single sign-on on. Enforcing it for everyone is possible only after a passing sign-in test, and asks first.
Choose Save at the top of the page to save your changes; each step shows when it is done. Once single sign-on is on, people with an email address of your domains sign in through your company’s identity provider, see Profile and sign-in. Sign-on events are recorded in the audit log.
Several workspaces
You can belong to more than one workspace, for example if you are an agency working for several clients. Switch workspaces from the workspace menu: click the workspace name at the top left and choose Switch to …. Each workspace has its own teams, integrations, billing and audit log; nothing is shared between them.
Deleting a workspace
Only the owner can delete a workspace:
- Open Workspace settings > General (
/<workspace>/settings/general) and scroll to the Danger zone at the bottom. - Click Delete workspace.
- Type the workspace’s name and click Delete workspace.
The app then switches to your next workspace. Admins and members see the Danger zone without the button.
Caution
Deleting a workspace stops all work in every team, closes open decisions, revokes all API tokens, switches off webhooks and self-hosted runners and erases the stored model provider keys. The workspace disappears for every member. It cannot be undone in the app, and after 30 days everything in it is erased for good. Your tracker issues and pull requests are not affected. See Retention and deletion.
Related pages
Last updated: January 1, 0001
Open kanman