Who may do what

Three roles per workspace: „Inhaber“ (owner), „Admin“, „Mitglied“ (member). The role belongs to the membership, not to the account — somebody in two workspaces can be owner in one and member in the other.

The signed-in product speaks German, so its labels are quoted in German throughout, with the English rendering in italics.

Daily work is open

For batches it is not access that differs but quantity: owners and admins may use 100 cells per batch, a member 25.

Settings are not open

Reading and changing often diverge here:

A member reads the formats, the label templates and the defaults — the editor works with them. They simply do not see the management surface.

Managing members

An invitation can only grant „Mitglied“ or „Admin“. The owner role is not reachable through an invitation.

Four constraints that apply on top

1. Nobody changes their own membership. There is no menu on your own row.
2. Only an owner may manage an owner, or grant and revoke the owner role. An admin sees no menu on an owner's row.
3. There is no role change on a deactivated member.
4. The caller must still be active themselves. A deactivated membership loses its rights immediately, even with a valid session.

Billing: seeing is not committing

An admin does not lose the purchase controls silently — a sentence stands in their place. Same for the spending limit: they see the state as a sentence, not as a switch.

SSO: reading is not setting up

Where an admin tries to save the connection they get no generic permission error but a sentence naming the role.

A member admitted automatically through the identity provider can become „Mitglied“ or „Admin“ — „Inhaber“ is not selectable as a default role.

What a member sees instead

The „Einstellungen“ menu entry not at all, and with it none of the sub-pages. Anyone opening the address directly gets a "not found" page — that holds for the audit export too.

SSO and billing deviate: they show the admin the state and replace the controls with a sentence.

Most often, though, a member does not meet the role boundary in the settings at all but at an allowance refusal while uploading. There they get no dead link but a sentence saying who can act.

A member sees no notice about payment arrears; they get the applicable sentence only at the refusal.

The second axis: the plan

Role and plan are independent. Some owner rights additionally depend on a plan capability — adding a domain and saving an SSO connection, for instance. Both are checked; the role alone is not enough.