Identify the role
A workspace may distinguish members, guests, administrators, and owners, though names and privileges vary by service. A role should reflect the work someone needs to do, not simply their job title. Check the provider’s documented permission matrix.
Review the actual access
Ask which conversations and files a person can read, whether they can invite others, and whether they can change settings or install integrations. A limited role can still expose sensitive information if it includes the wrong space.
Change access deliberately
Use an approved request and review process for elevated privileges. Remove temporary access when the task ends and recheck permissions after a role change or departure. Keep at least one recovery path under organizational control.
Review access after a role change
A teammate moving from project lead to contributor may no longer need administrator privileges, but may still need access to the project record. Review each requirement separately: member identity, conversation access, administrative rights, integrations, and document permissions. Apply the organization’s change process and check that a responsible owner remains. An employee’s new job title alone does not tell you which controls are appropriate.
Choose the next step
| Situation | What to check |
|---|---|
| Short-term elevated access | Set a purpose, approver, and expiry or review date. |
| A contractor finishes work | Remove or review workspace and linked-file access. |
| An owner departs | Transfer ownership and verify the recovery path. |
A practical checklist
- Identify the required tasks.
- Match the role to documented permissions.
- Limit sensitive access and elevated privileges.
- Review and remove access as responsibilities change.