Appearance
Who can do what
dx0 has three customer roles. Use this page to choose a role for each person, to lock down who can connect systems, and to answer an access review or security questionnaire.
The three roles
| Role | Applies to | In one line |
|---|---|---|
| Admin | The whole account | Everything in every workspace, plus people, workspaces and billing. |
| Workspace Admin | One workspace | Runs that workspace: its members, connections and settings. No power in other workspaces or over the account. |
| Standard user | One workspace | Uses dx0 fully but administers nothing. |
A person has one account role (Admin or Standard user) and, in each workspace they belong to, one workspace role (Workspace Admin or Standard user). An Admin is automatically treated as an admin in every workspace on the account, including workspaces they haven't been added to.
Roles only ever add access; no role takes it away. If someone is a Standard user on the account and a Workspace Admin in the Acme workspace, they have Workspace Admin access in Acme and Standard user access everywhere else.
The person who created the account is its owner. The owner is always an Admin. Ownership gives no extra access, but it can't be taken away (see Safeguards).
What each role can do
Yes means allowed. Own means only items that person created. Setting means allowed unless a workspace turns it off (see the next section). — means not allowed. Workspace Admin access applies only in the workspaces where the person holds that role.
People, workspaces and billing
| Action | Standard user | Workspace Admin | Admin |
|---|---|---|---|
| Open a workspace | Workspaces they belong to | Workspaces they belong to | Every workspace on the account |
| Invite someone new, or add a colleague, to a workspace | — | Yes | Yes |
| Change someone's workspace role, or remove them from a workspace | — | Yes | Yes |
| Make someone an Admin, or change their account role | — | — | Yes |
| Delete a user from the account | — | — | Yes |
| See how many seats are in use | — | — | Yes |
| Change workspace settings (AI response language, bring-your-own storage, the connection setting below) | — | Yes | Yes |
| Create, rename or delete a workspace | — | — | Yes |
| Manage billing | — | — | Yes |
Connections
| Action | Standard user | Workspace Admin | Admin |
|---|---|---|---|
| Connect, re-authorize, rename or disconnect a Salesforce org | Setting | Yes | Yes |
| Start or cancel indexing of a connected Workato workspace | Setting | Yes | Yes |
| Connect or disconnect GitHub, GitLab or Bitbucket, and choose repositories | — | Yes | Yes |
| Add, update or remove Workato credentials | — | Yes | Yes |
| Turn on live record access for the account, and choose who can query live records on each org | — | — | Yes |
Git and Workato connections are never available to Standard users. Authorizing GitLab or Bitbucket exposes every project the authorizing person can reach, and one Workato credential can cover many projects. Live record access is limited to Admins because it lets dx0's AI query production data.
Your work in dx0
| Action | Standard user | Workspace Admin | Admin |
|---|---|---|---|
| Ask dx0's AI and keep conversations | Own | Own | Own |
| Upload files, and read every file in the workspace | Yes | Yes | Yes |
| Delete a file | Own | Own | Any |
| Create context notes, and read your own plus every public note | Yes | Yes | Yes |
| Read, edit or delete another member's private context note | — | — | Yes |
| Edit or delete a context note | Own | Own | Any |
| Create prompt templates, and read your own plus every public template on the account | Yes | Yes | Yes |
| Edit or delete a prompt template, including private ones | Own | Own | Any |
| Read and publish Knowledge Hub articles | Yes | Yes | Yes |
| Delete a Knowledge Hub article | Own | Any in their workspace | Any |
| Read recommendations | Yes | Yes | Yes |
Conversations are private to the person who had them. Nobody else can open them, Admins included. Recommendations are read-only for everyone.
API keys and AI agents
| Action | Standard user | Workspace Admin | Admin |
|---|---|---|---|
| Create and revoke your own API keys | Yes | Yes | Yes |
| Connect and disconnect your own AI agents | Yes | Yes | Yes |
| See and revoke any member's API keys and connected agents | — | — | Yes |
An API key or connected agent never has more access than the person it belongs to. It also carries their role into each workspace: if you're a Workspace Admin in Acme and a Standard user in Globex, your agent has exactly that access in each. See The dx0 MCP for which workspaces an agent can reach.
Lock down Salesforce connections in a workspace
By default, every member of a workspace can connect and manage Salesforce orgs and run indexing. Consultancies usually want this: whoever is on a client's project can connect that client's org without waiting for an admin.
A Workspace Admin or Admin can turn this off for one workspace on its Members page. Once it's off, only Workspace Admins and Admins can manage that workspace's connections. Standard users keep the rest of their access. The change applies to every member on their next action, without signing anyone out.
Safeguards
- The owner can't be locked out. The owner's role can't be changed, and they can't be removed from a workspace or deleted.
- Every workspace keeps an admin. You can't demote or remove a workspace's last Workspace Admin.
- Workspace changes apply immediately. dx0 checks workspace roles and workspace settings on every request.
- Removing someone from the account cuts off all access. It removes them from every workspace, signs them out on every device, revokes their API keys and disconnects their AI agents.
- Accounts are isolated. No role, including Admin, reaches another customer's account.
- dx0 staff access is separate. dx0 support uses a separate internal role that you can't assign and no API key can carry.
Practical scenarios
Staffing a client engagement. Create a workspace per client, make the engagement lead its Workspace Admin, and let them add the rest of the team. They can't see other clients' workspaces or change account roles.
Locking down a regulated client. For a client whose production org needs change control, turn off Salesforce connections for members in that workspace so only its Workspace Admin can connect or disconnect orgs.
Offboarding a consultant. An Admin deletes the user from the account. Their sessions, API keys and connected agents stop working at once, and any files or notes they left can be cleaned up by an Admin.
Answering a security questionnaire. Point the reviewer to this page. Every rule here is enforced by dx0's servers, not only hidden in the interface.
Giving an AI agent narrow access. Add the person only to the workspaces their agent needs. The agent can never reach more than they can.