From 596463b540780a73516ba2e0ff28a35d97e7aab8 Mon Sep 17 00:00:00 2001 From: rachaelrenk Date: Wed, 29 Jul 2026 16:08:55 +0000 Subject: [PATCH 1/5] docs: workspace admin roles (workspace-admin-roles) [auto-draft] Auto-drafted from warp-server spec workspace-admin-roles (PRODUCT.md only). Co-Authored-By: Oz --- .../team-management/workspace-admin-roles.mdx | 107 ++++++++++++++++++ src/sidebar.ts | 2 + 2 files changed, 109 insertions(+) create mode 100644 src/content/docs/enterprise/team-management/workspace-admin-roles.mdx diff --git a/src/content/docs/enterprise/team-management/workspace-admin-roles.mdx b/src/content/docs/enterprise/team-management/workspace-admin-roles.mdx new file mode 100644 index 000000000..201b38bda --- /dev/null +++ b/src/content/docs/enterprise/team-management/workspace-admin-roles.mdx @@ -0,0 +1,107 @@ +--- +title: Workspace admin roles +description: >- + Workspace admin roles let designated members manage membership, billing, + settings, and policies across every team in a Warp workspace. Learn what the + User, Admin, and Owner roles can do. +--- + +A workspace is the primary organizational unit in Warp and can contain multiple teams. Workspace admin roles let you delegate management of the whole workspace — membership, billing, settings, and policies — to more than one person, with capabilities that are a superset of team-level admin capabilities. + +:::note +Workspace roles are additive. They grant permissions on top of a member's existing team-level roles without changing their team memberships. Being a workspace admin does not change your role on any individual team. +::: + +:::caution +This page describes the behavioral contract for workspace admin roles. The dedicated management surfaces for workspace roles are being built as separate work. Some capabilities — workspace invite links, email invites, domain restrictions, and workspace-level spend limits — describe the intended contract but ship as follow-up after the role model lands. [TODO: engineer to verify which capabilities are available in the current release.] +::: + +## Workspace roles + +Every workspace membership has exactly one role: + +* **User** - The default, non-privileged membership. Users can use Warp normally but cannot manage workspace settings, billing, or membership. +* **Admin** - A workspace-level admin with broad management capabilities across the workspace. A workspace can have zero or more admins. +* **Owner** - The highest-privilege role. There is exactly one owner per workspace at all times. The owner is the member who created the workspace, or who was explicitly transferred ownership. + +The term *admin-level* means Admin or Owner. Any capability described as requiring admin-level permissions is available to both roles unless it is explicitly marked as owner-only. + +## How workspace roles work + +Workspaces can contain many teams, so the workspace role sits above team-level roles: + +* **Admin-level permissions across every team** - A workspace admin has admin-level permissions on every team in the workspace, even if their membership role on a given team is User. +* **Additive, not destructive** - Promoting or demoting a workspace role never changes a member's team-level roles. A member demoted from workspace Admin to User keeps any team-level admin role they already held. +* **Team admin is not workspace admin** - A team-level admin who is not a workspace admin keeps their admin powers for that specific team only. Team-level admin does not grant workspace-level admin. +* **Owner as a root of trust** - The owner cannot be removed by an admin and cannot be demoted without first transferring ownership, which bounds the impact of a compromised or rogue admin. + +### Two paths for managing roles + +How roles are managed depends on whether the plan supports multi-team workspaces: + +* **Self-serve plans (no multi-team workspace support)** - The team is the sole management surface. Roles are managed through the existing team actions, and team roles are mirrored to workspace roles, including ownership transfer. Workspace-level member management actions are unavailable. +* **Multi-team-capable plans** - Workspace roles are managed independently through workspace-level actions. Team actions no longer mirror into workspace roles, and workspace ownership changes only through a workspace ownership transfer. + +## Workspace admin capabilities + +Workspace admins (Admin or Owner) can manage the workspace across the following areas. + +### Member management + +* **View members** - View all members of the workspace and their roles. +* **Remove members** - Remove any User-role member from the workspace. Removing a member also removes them from all teams within the workspace. If the member owns a team, that team's ownership must be transferred before they can be removed. +* **Remove other admins** - Remove another Admin from the workspace. An admin cannot remove the owner. +* **Change roles** - Promote a User to Admin, or demote an Admin to User. Only the owner can promote someone to Owner, which is an ownership transfer. +* **Invite members** - Invite new members to the workspace via invite link or email invite, subject to any domain restrictions in effect. [TODO: engineer to verify — invite links, email invites, and domain restrictions are listed as follow-up work in the spec; confirm availability.] +* **Manage the invite link** - Enable, disable, or reset (regenerate) the workspace invite link. [TODO: engineer to verify availability.] +* **Manage domain restrictions** - Add or remove approved email domains for the workspace invite link. [TODO: engineer to verify availability.] + +### Billing + +* **Manage spend limits** - Manage spend limits at the workspace level, team level, or for individual workspace members. [TODO: engineer to verify — workspace-level spend limits are listed as follow-up work; team- and member-level limits ship via team-level inheritance in V1.] + +### Oz agent run visibility + +Workspace admins have full access to all team-owned Oz agent runs across every team in the workspace: + +* **Full access, not view-only** - Admins can both view run details and take management actions, such as cancelling a run, on any team-owned run — including runs started by other members on teams the admin does not personally belong to. +* **Same data boundary as a team member** - A workspace admin sees exactly what a member of the owning team can see for a run today, including prompts, logs, artifacts, and repository context. No redaction is applied. +* **Personal runs stay private** - Runs owned directly by a user rather than a team — for example, runs created with the "Only visible to me" option — remain visible only to their owner. Neither team admins nor workspace admins gain access. + +A workspace User keeps the current behavior: they can see only their own runs and runs belonging to their team or teams. + +### Team-level management + +Because a workspace admin has admin-level permissions on every team in the workspace, they can perform all team admin operations on any team: + +* Remove team members. +* Change team-level roles. +* Manage team invite links and domain restrictions. +* Rename teams. + +## Owner-only capabilities + +Some actions are reserved for the workspace owner: + +* **Transfer ownership** - Only the owner can transfer ownership to another workspace member. When ownership is transferred, the new owner's role becomes Owner. The previous owner becomes Admin when the workspace's plan supports multiple admins, or User otherwise. No team-level roles change. + +## Role changes and constraints + +Workspace role changes follow a few self-service safeguards: + +* **The owner cannot demote themselves** - To step down, the owner must transfer ownership to another member first. +* **An admin cannot remove themselves** - Another admin or the owner must remove them. +* **Demotion is immediate** - When an admin is demoted to User, they lose workspace-level admin capabilities right away, but keep any team-level admin role they already held. + +## Managing workspace roles + +[TODO: docs reviewer — add the step-by-step procedure and settings path for promoting, demoting, and transferring workspace roles once the workspace management UI ships. The dedicated workspace management surfaces are not yet defined in the spec (UI design is called out as separate follow-up work), so no settings path is documented here. UNVERIFIED: exact Settings menu path for workspace role management.] + +[TODO: docs reviewer — screenshot needed: workspace member management surface showing roles.] + +## Related pages + +* [Roles and permissions](/enterprise/team-management/roles-and-permissions/) - Team-level roles, permissions, and settings enforcement. +* [Team management in Warp](/enterprise/team-management/teams/) - Create and manage teams, invites, and ownership transfer. +* [Admin Panel](/enterprise/team-management/admin-panel/) - Configure settings and enforce policies. +* [Viewing cloud agent runs](/platform/viewing-cloud-agent-runs/) - How Oz agent run visibility works. diff --git a/src/sidebar.ts b/src/sidebar.ts index 2fd67f52b..cf6870823 100644 --- a/src/sidebar.ts +++ b/src/sidebar.ts @@ -630,6 +630,8 @@ export const sidebarTopics: StarlightSidebarTopicsUserConfig = [ 'enterprise/team-management/teams', { slug: 'enterprise/team-management/admin-panel', label: 'Admin panel' }, { slug: 'enterprise/team-management/roles-and-permissions', label: 'Roles and permissions' }, + // [TODO: docs reviewer — confirm placement] + { slug: 'enterprise/team-management/workspace-admin-roles', label: 'Workspace admin roles' }, ], }, { From 76e6525200f074c55c44bba32b269ee05e3adc5e Mon Sep 17 00:00:00 2001 From: Rachael Rose Renk <91027132+rachaelrenk@users.noreply.github.com> Date: Thu, 8 Oct 2026 11:34:07 -0600 Subject: [PATCH 2/5] docs: fold workspace admin roles into the Workspaces page Replace the standalone workspace-admin-roles page with verified content on the existing Workspaces page, which already covers workspace roles, teams, invitations, and spend limits. - Add Workspace admin permissions, Changing workspace roles, and Cloud agent run visibility sections to workspaces.mdx - Remove the standalone page and its sidebar entry - Drop claims that could not be verified against warp-server Co-Authored-By: Warp --- .../team-management/workspace-admin-roles.mdx | 107 ------------------ .../enterprise/team-management/workspaces.mdx | 30 +++++ src/sidebar.ts | 2 - 3 files changed, 30 insertions(+), 109 deletions(-) delete mode 100644 src/content/docs/enterprise/team-management/workspace-admin-roles.mdx diff --git a/src/content/docs/enterprise/team-management/workspace-admin-roles.mdx b/src/content/docs/enterprise/team-management/workspace-admin-roles.mdx deleted file mode 100644 index 201b38bda..000000000 --- a/src/content/docs/enterprise/team-management/workspace-admin-roles.mdx +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: Workspace admin roles -description: >- - Workspace admin roles let designated members manage membership, billing, - settings, and policies across every team in a Warp workspace. Learn what the - User, Admin, and Owner roles can do. ---- - -A workspace is the primary organizational unit in Warp and can contain multiple teams. Workspace admin roles let you delegate management of the whole workspace — membership, billing, settings, and policies — to more than one person, with capabilities that are a superset of team-level admin capabilities. - -:::note -Workspace roles are additive. They grant permissions on top of a member's existing team-level roles without changing their team memberships. Being a workspace admin does not change your role on any individual team. -::: - -:::caution -This page describes the behavioral contract for workspace admin roles. The dedicated management surfaces for workspace roles are being built as separate work. Some capabilities — workspace invite links, email invites, domain restrictions, and workspace-level spend limits — describe the intended contract but ship as follow-up after the role model lands. [TODO: engineer to verify which capabilities are available in the current release.] -::: - -## Workspace roles - -Every workspace membership has exactly one role: - -* **User** - The default, non-privileged membership. Users can use Warp normally but cannot manage workspace settings, billing, or membership. -* **Admin** - A workspace-level admin with broad management capabilities across the workspace. A workspace can have zero or more admins. -* **Owner** - The highest-privilege role. There is exactly one owner per workspace at all times. The owner is the member who created the workspace, or who was explicitly transferred ownership. - -The term *admin-level* means Admin or Owner. Any capability described as requiring admin-level permissions is available to both roles unless it is explicitly marked as owner-only. - -## How workspace roles work - -Workspaces can contain many teams, so the workspace role sits above team-level roles: - -* **Admin-level permissions across every team** - A workspace admin has admin-level permissions on every team in the workspace, even if their membership role on a given team is User. -* **Additive, not destructive** - Promoting or demoting a workspace role never changes a member's team-level roles. A member demoted from workspace Admin to User keeps any team-level admin role they already held. -* **Team admin is not workspace admin** - A team-level admin who is not a workspace admin keeps their admin powers for that specific team only. Team-level admin does not grant workspace-level admin. -* **Owner as a root of trust** - The owner cannot be removed by an admin and cannot be demoted without first transferring ownership, which bounds the impact of a compromised or rogue admin. - -### Two paths for managing roles - -How roles are managed depends on whether the plan supports multi-team workspaces: - -* **Self-serve plans (no multi-team workspace support)** - The team is the sole management surface. Roles are managed through the existing team actions, and team roles are mirrored to workspace roles, including ownership transfer. Workspace-level member management actions are unavailable. -* **Multi-team-capable plans** - Workspace roles are managed independently through workspace-level actions. Team actions no longer mirror into workspace roles, and workspace ownership changes only through a workspace ownership transfer. - -## Workspace admin capabilities - -Workspace admins (Admin or Owner) can manage the workspace across the following areas. - -### Member management - -* **View members** - View all members of the workspace and their roles. -* **Remove members** - Remove any User-role member from the workspace. Removing a member also removes them from all teams within the workspace. If the member owns a team, that team's ownership must be transferred before they can be removed. -* **Remove other admins** - Remove another Admin from the workspace. An admin cannot remove the owner. -* **Change roles** - Promote a User to Admin, or demote an Admin to User. Only the owner can promote someone to Owner, which is an ownership transfer. -* **Invite members** - Invite new members to the workspace via invite link or email invite, subject to any domain restrictions in effect. [TODO: engineer to verify — invite links, email invites, and domain restrictions are listed as follow-up work in the spec; confirm availability.] -* **Manage the invite link** - Enable, disable, or reset (regenerate) the workspace invite link. [TODO: engineer to verify availability.] -* **Manage domain restrictions** - Add or remove approved email domains for the workspace invite link. [TODO: engineer to verify availability.] - -### Billing - -* **Manage spend limits** - Manage spend limits at the workspace level, team level, or for individual workspace members. [TODO: engineer to verify — workspace-level spend limits are listed as follow-up work; team- and member-level limits ship via team-level inheritance in V1.] - -### Oz agent run visibility - -Workspace admins have full access to all team-owned Oz agent runs across every team in the workspace: - -* **Full access, not view-only** - Admins can both view run details and take management actions, such as cancelling a run, on any team-owned run — including runs started by other members on teams the admin does not personally belong to. -* **Same data boundary as a team member** - A workspace admin sees exactly what a member of the owning team can see for a run today, including prompts, logs, artifacts, and repository context. No redaction is applied. -* **Personal runs stay private** - Runs owned directly by a user rather than a team — for example, runs created with the "Only visible to me" option — remain visible only to their owner. Neither team admins nor workspace admins gain access. - -A workspace User keeps the current behavior: they can see only their own runs and runs belonging to their team or teams. - -### Team-level management - -Because a workspace admin has admin-level permissions on every team in the workspace, they can perform all team admin operations on any team: - -* Remove team members. -* Change team-level roles. -* Manage team invite links and domain restrictions. -* Rename teams. - -## Owner-only capabilities - -Some actions are reserved for the workspace owner: - -* **Transfer ownership** - Only the owner can transfer ownership to another workspace member. When ownership is transferred, the new owner's role becomes Owner. The previous owner becomes Admin when the workspace's plan supports multiple admins, or User otherwise. No team-level roles change. - -## Role changes and constraints - -Workspace role changes follow a few self-service safeguards: - -* **The owner cannot demote themselves** - To step down, the owner must transfer ownership to another member first. -* **An admin cannot remove themselves** - Another admin or the owner must remove them. -* **Demotion is immediate** - When an admin is demoted to User, they lose workspace-level admin capabilities right away, but keep any team-level admin role they already held. - -## Managing workspace roles - -[TODO: docs reviewer — add the step-by-step procedure and settings path for promoting, demoting, and transferring workspace roles once the workspace management UI ships. The dedicated workspace management surfaces are not yet defined in the spec (UI design is called out as separate follow-up work), so no settings path is documented here. UNVERIFIED: exact Settings menu path for workspace role management.] - -[TODO: docs reviewer — screenshot needed: workspace member management surface showing roles.] - -## Related pages - -* [Roles and permissions](/enterprise/team-management/roles-and-permissions/) - Team-level roles, permissions, and settings enforcement. -* [Team management in Warp](/enterprise/team-management/teams/) - Create and manage teams, invites, and ownership transfer. -* [Admin Panel](/enterprise/team-management/admin-panel/) - Configure settings and enforce policies. -* [Viewing cloud agent runs](/platform/viewing-cloud-agent-runs/) - How Oz agent run visibility works. diff --git a/src/content/docs/enterprise/team-management/workspaces.mdx b/src/content/docs/enterprise/team-management/workspaces.mdx index 9820971b2..dfa0c0a8d 100644 --- a/src/content/docs/enterprise/team-management/workspaces.mdx +++ b/src/content/docs/enterprise/team-management/workspaces.mdx @@ -6,6 +6,7 @@ description: >- Workspaces group teams under one Enterprise account with shared membership, billing, SSO, and company-wide settings. --- +import { VARS } from '@data/vars'; A workspace groups one or more teams under a single Enterprise account. Workspace admins manage membership, billing, and company-wide policies across those teams. Single Sign-On (SSO) is configured at the workspace level. @@ -27,6 +28,27 @@ Every workspace member has one of three roles: In team member lists, the **Workspace admin** and **Workspace owner** badges distinguish workspace roles from team roles. +## Workspace admin permissions + +A workspace admin has admin-level permissions on every team in the workspace, even on teams where their team role is Member. Team admins who aren't workspace admins keep admin permissions only on their own team. + +Workspace admins can: + +* **Manage members** - View everyone in the workspace, promote members to Admin, demote admins, and remove members or other admins. Removing a member also removes them from every team in the workspace. +* **Manage invitations** - Send email invites, and enable, disable, or reset the workspace invite link and its approved email domains. See [Joining a workspace or team](#joining-a-workspace-or-team). +* **Manage teams** - Create teams and manage the membership and settings of any team. +* **Manage settings, billing, and spend limits** - See [Workspace settings and team settings](#workspace-settings-and-team-settings) and [Workspace spend limits](#workspace-spend-limits). +* **View and manage cloud agent runs** - See [Cloud agent run visibility](#cloud-agent-run-visibility). + +## Changing workspace roles + +In the [Admin Panel](/enterprise/team-management/admin-panel/), open **Members** and use the three-dots menu on a member's row to promote, demote, remove, or transfer ownership. + +* **Roles are additive** - Changing a workspace role never changes a member's team roles. An admin who is demoted loses workspace admin access immediately but keeps any team admin role they already had. +* **Only the owner transfers ownership** - The previous owner becomes an Admin on plans that support multiple admins, and a Member on other plans. +* **The owner stays in place** - Admins can't remove the owner or change the owner's role. To step down, the owner transfers ownership first. +* **Leaving a workspace** - Members of Enterprise workspaces can't remove themselves. An admin removes them. + ## Teams inside a workspace Workspace admins create teams from the Admin Panel and choose a visibility: @@ -52,6 +74,14 @@ An unassigned user belongs to the workspace but not to a team. Workspace admins Unassigned users cannot start cloud agent or factory runs until they join a team. Workspace-level billing and policies still apply to them. +## Cloud agent run visibility + +Workspace admins can view and manage every team-owned {VARS.PLATFORM_RUN} in the workspace, including runs that members of other teams started. They can see what a member of the owning team sees, such as the prompt, logs, and artifacts. + +Runs owned by an individual user rather than a team stay private to that user. Neither team admins nor workspace admins can see them. Members who aren't admins see their own runs and their teams' runs. + +For how to open and steer a run, see [Viewing cloud agent runs](/platform/viewing-cloud-agent-runs/). + ## Workspace settings and team settings Workspace admins configure company-wide policies in the [Admin Panel](/enterprise/team-management/admin-panel/). For supported settings, they can enforce a value across the workspace or select **Respect Team Setting** to let each team decide. diff --git a/src/sidebar.ts b/src/sidebar.ts index 8b079c84a..5ac2af3a5 100644 --- a/src/sidebar.ts +++ b/src/sidebar.ts @@ -791,8 +791,6 @@ export const sidebarTopics: StarlightSidebarTopicsUserConfig = [ 'enterprise/team-management/teams', { slug: 'enterprise/team-management/admin-panel', label: 'Admin panel' }, { slug: 'enterprise/team-management/roles-and-permissions', label: 'Roles and permissions' }, - // [TODO: docs reviewer — confirm placement] - { slug: 'enterprise/team-management/workspace-admin-roles', label: 'Workspace admin roles' }, ], }, { From 201ac3a8c6bfe721a38129613d7dcb174d2ada9a Mon Sep 17 00:00:00 2001 From: Rachael Rose Renk <91027132+rachaelrenk@users.noreply.github.com> Date: Thu, 8 Oct 2026 13:30:28 -0600 Subject: [PATCH 3/5] docs: address review findings on workspace admin permissions - Point the "Manage teams" bullet at Teams inside a workspace instead of repeating the team-management statement - Drop the unnamed plan split for ownership transfer; the previous owner becomes an Admin on every workspace this page covers - Describe run visibility as the same access as a team member, removing the unverified list of what a run exposes Co-Authored-By: Warp --- src/content/docs/enterprise/team-management/workspaces.mdx | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/content/docs/enterprise/team-management/workspaces.mdx b/src/content/docs/enterprise/team-management/workspaces.mdx index dfa0c0a8d..406e42834 100644 --- a/src/content/docs/enterprise/team-management/workspaces.mdx +++ b/src/content/docs/enterprise/team-management/workspaces.mdx @@ -36,7 +36,7 @@ Workspace admins can: * **Manage members** - View everyone in the workspace, promote members to Admin, demote admins, and remove members or other admins. Removing a member also removes them from every team in the workspace. * **Manage invitations** - Send email invites, and enable, disable, or reset the workspace invite link and its approved email domains. See [Joining a workspace or team](#joining-a-workspace-or-team). -* **Manage teams** - Create teams and manage the membership and settings of any team. +* **Manage teams** - Create teams and manage any team. See [Teams inside a workspace](#teams-inside-a-workspace). * **Manage settings, billing, and spend limits** - See [Workspace settings and team settings](#workspace-settings-and-team-settings) and [Workspace spend limits](#workspace-spend-limits). * **View and manage cloud agent runs** - See [Cloud agent run visibility](#cloud-agent-run-visibility). @@ -45,7 +45,7 @@ Workspace admins can: In the [Admin Panel](/enterprise/team-management/admin-panel/), open **Members** and use the three-dots menu on a member's row to promote, demote, remove, or transfer ownership. * **Roles are additive** - Changing a workspace role never changes a member's team roles. An admin who is demoted loses workspace admin access immediately but keeps any team admin role they already had. -* **Only the owner transfers ownership** - The previous owner becomes an Admin on plans that support multiple admins, and a Member on other plans. +* **Only the owner transfers ownership** - The previous owner becomes an Admin. * **The owner stays in place** - Admins can't remove the owner or change the owner's role. To step down, the owner transfers ownership first. * **Leaving a workspace** - Members of Enterprise workspaces can't remove themselves. An admin removes them. @@ -76,7 +76,7 @@ Unassigned users cannot start cloud agent or factory runs until they join a team ## Cloud agent run visibility -Workspace admins can view and manage every team-owned {VARS.PLATFORM_RUN} in the workspace, including runs that members of other teams started. They can see what a member of the owning team sees, such as the prompt, logs, and artifacts. +Workspace admins can view and manage every team-owned {VARS.PLATFORM_RUN} in the workspace, including runs that members of other teams started. They have the same access to a team's runs as a member of that team. Runs owned by an individual user rather than a team stay private to that user. Neither team admins nor workspace admins can see them. Members who aren't admins see their own runs and their teams' runs. From 7f25471f92be06b2983ead9f4961874b27aed3e4 Mon Sep 17 00:00:00 2001 From: "warp-agent-staging[bot]" <240773466+warp-agent-staging[bot]@users.noreply.github.com> Date: Sat, 10 Oct 2026 20:03:01 +0000 Subject: [PATCH 4/5] docs: address workspace admin roles review Co-Authored-By: Oz --- .../enterprise/team-management/workspaces.mdx | 29 +++++++------------ 1 file changed, 11 insertions(+), 18 deletions(-) diff --git a/src/content/docs/enterprise/team-management/workspaces.mdx b/src/content/docs/enterprise/team-management/workspaces.mdx index 406e42834..3929a2800 100644 --- a/src/content/docs/enterprise/team-management/workspaces.mdx +++ b/src/content/docs/enterprise/team-management/workspaces.mdx @@ -23,31 +23,17 @@ A workspace provides company-wide administration, while teams organize shared re Every workspace member has one of three roles: * **Member** - Uses Warp within their teams and the policies admins configure. -* **Admin** - Manages workspace membership, billing, and settings. Admins can view and manage every team, including teams they don't belong to. +* **Admin** - Manages workspace membership, billing, settings, and every team, including teams they don't belong to. Workspace admins have admin-level permissions on every team; team admins who aren't workspace admins have admin permissions only on their teams. * **Owner** - Has every admin capability and can transfer ownership to another member. Each workspace has one owner. In team member lists, the **Workspace admin** and **Workspace owner** badges distinguish workspace roles from team roles. ## Workspace admin permissions -A workspace admin has admin-level permissions on every team in the workspace, even on teams where their team role is Member. Team admins who aren't workspace admins keep admin permissions only on their own team. - Workspace admins can: * **Manage members** - View everyone in the workspace, promote members to Admin, demote admins, and remove members or other admins. Removing a member also removes them from every team in the workspace. * **Manage invitations** - Send email invites, and enable, disable, or reset the workspace invite link and its approved email domains. See [Joining a workspace or team](#joining-a-workspace-or-team). -* **Manage teams** - Create teams and manage any team. See [Teams inside a workspace](#teams-inside-a-workspace). -* **Manage settings, billing, and spend limits** - See [Workspace settings and team settings](#workspace-settings-and-team-settings) and [Workspace spend limits](#workspace-spend-limits). -* **View and manage cloud agent runs** - See [Cloud agent run visibility](#cloud-agent-run-visibility). - -## Changing workspace roles - -In the [Admin Panel](/enterprise/team-management/admin-panel/), open **Members** and use the three-dots menu on a member's row to promote, demote, remove, or transfer ownership. - -* **Roles are additive** - Changing a workspace role never changes a member's team roles. An admin who is demoted loses workspace admin access immediately but keeps any team admin role they already had. -* **Only the owner transfers ownership** - The previous owner becomes an Admin. -* **The owner stays in place** - Admins can't remove the owner or change the owner's role. To step down, the owner transfers ownership first. -* **Leaving a workspace** - Members of Enterprise workspaces can't remove themselves. An admin removes them. ## Teams inside a workspace @@ -76,11 +62,18 @@ Unassigned users cannot start cloud agent or factory runs until they join a team ## Cloud agent run visibility -Workspace admins can view and manage every team-owned {VARS.PLATFORM_RUN} in the workspace, including runs that members of other teams started. They have the same access to a team's runs as a member of that team. +Workspace admins can view and manage each team-owned {VARS.PLATFORM_RUN} in the workspace, including runs that members of other teams started. Their access matches members of the team that owns the run. + +Workspace and team roles don't grant access to runs owned by an individual user. Only the user who owns a run can access it by default, though the owner can choose to [share the session](/platform/viewing-cloud-agent-runs/). Other members can access their own runs and runs owned by their teams. + +## Changing workspace roles -Runs owned by an individual user rather than a team stay private to that user. Neither team admins nor workspace admins can see them. Members who aren't admins see their own runs and their teams' runs. +In the Warp app, open the [Admin Panel](/enterprise/team-management/admin-panel/), click **Members**, then use the three-dots menu on a member's row to promote, demote, remove, or transfer ownership. -For how to open and steer a run, see [Viewing cloud agent runs](/platform/viewing-cloud-agent-runs/). +* **Roles are additive** - Changing a workspace role never changes a member's team roles. An admin who is demoted loses workspace admin access immediately but keeps any team admin role they already had. +* **Only the owner transfers ownership** - The previous owner becomes an Admin. +* **The owner stays in place** - Admins can't remove the owner or change the owner's role. To step down, the owner transfers ownership first. +* **Leaving a workspace** - Members can't leave an Enterprise workspace themselves. A workspace admin removes them instead. ## Workspace settings and team settings From a1efcef359594571b036da999bac2708b76de2e4 Mon Sep 17 00:00:00 2001 From: Rachael Rose Renk <91027132+rachaelrenk@users.noreply.github.com> Date: Mon, 19 Oct 2026 10:29:44 -0600 Subject: [PATCH 5/5] docs: address workspace admin review feedback Co-Authored-By: Warp --- .../docs/enterprise/team-management/workspaces.mdx | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/content/docs/enterprise/team-management/workspaces.mdx b/src/content/docs/enterprise/team-management/workspaces.mdx index 3929a2800..819880497 100644 --- a/src/content/docs/enterprise/team-management/workspaces.mdx +++ b/src/content/docs/enterprise/team-management/workspaces.mdx @@ -23,7 +23,7 @@ A workspace provides company-wide administration, while teams organize shared re Every workspace member has one of three roles: * **Member** - Uses Warp within their teams and the policies admins configure. -* **Admin** - Manages workspace membership, billing, settings, and every team, including teams they don't belong to. Workspace admins have admin-level permissions on every team; team admins who aren't workspace admins have admin permissions only on their teams. +* **Admin** - Manages workspace membership, billing, and settings, with admin-level permissions on every team, including teams they don't belong to. Team admins who aren't workspace admins have admin permissions only on their teams. * **Owner** - Has every admin capability and can transfer ownership to another member. Each workspace has one owner. In team member lists, the **Workspace admin** and **Workspace owner** badges distinguish workspace roles from team roles. @@ -68,7 +68,12 @@ Workspace and team roles don't grant access to runs owned by an individual user. ## Changing workspace roles -In the Warp app, open the [Admin Panel](/enterprise/team-management/admin-panel/), click **Members**, then use the three-dots menu on a member's row to promote, demote, remove, or transfer ownership. +To promote or demote a workspace admin: + +1. In the Warp app, open the [Admin Panel](/enterprise/team-management/admin-panel/) and click **Members**. +2. On the member's row, click the three-dots menu, then click **Promote to admin** to make them an Admin or **Demote admin** to make them a Member. If you're demoting yourself, click **Demote to member** in the confirmation dialog. + +The member's workspace role updates in the list. Use the same menu to remove a member or transfer ownership. * **Roles are additive** - Changing a workspace role never changes a member's team roles. An admin who is demoted loses workspace admin access immediately but keeps any team admin role they already had. * **Only the owner transfers ownership** - The previous owner becomes an Admin.