> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Members, invitations and sign-in

> Invite people by email, change or revoke their access, and read what governs sign-in, MFA and sessions in this workspace.

At the end of this page you have invited a colleague, you know how to change or remove anyone's access, and you know what governs sign-in. Inviting members and changing roles needs the **Admin** or **Owner** role.

## Invite a member

**1. Open Members**

Open **Settings › Members**. The **People** card shows who has access to this workspace, and at what privilege.

**2. Enter the address and the role**

Under **Invite new members by email address**, fill in **Email Address** and choose a **Role**: **Read**, **Policy Writer**, **Admin** or **Owner**. Click **Add More** to invite several people at once.

**3. Send the invitation**

Click **Invite Member**. The person gets an email and joins by signing in with that address. There is no link to forward. The invitation expires 14 days after it is sent.

**4. Watch it land**

The invitation sits under **Pending Invitations** until the person signs in. Then they appear under **Team Members** with the role you chose.

## Manage access

The two tabs are **Team Members** and **Pending Invitations**. Use **Filter…**, **All Roles** and **Date Added** to find a row. Each row has **Manage Role**, **Copy Email** and, for an invitation, **Revoke Invite…** and a resend action.

Removal is immediate in effect. The dashboard puts it this way: "Membership is re-read on every request, so a removal takes effect on the member's next call."

The four roles are enforced server-side on every call, highest privilege first. **Owner** reaches everything an **Admin** does, and the last owner cannot be removed. **Admin** reaches everything a **Policy Writer** does. **Policy Writer** reaches everything a **Read** member does. Every member can read all workspace data. You can change or remove only members whose current role is at or below your own: an **Admin** can change or remove a **Read** member, a **Policy Writer** or another **Admin**. Only an Owner can change or remove an Owner, or revoke an invitation to the **Owner** role. The matrix **What each role can do** lists each action; see [Roles and permissions](https://docs.quintai.dev/settings/roles-and-permissions.md).

## Feature visibility

**Feature visibility** decides which parts of the product the **Read** and **Policy Writer** roles can see. Admins and owners always see everything, so a change can always be undone. Untick a feature for a role and click **Save**. "Hidden features disappear from the navigation on the member's next page load." Every role can read this table. Only an **Admin** or **Owner** can change it: for the other roles the boxes and **Save** are disabled and the card reads "Admin only — your role can view this setting but not change it."

## Sign-in, MFA and sessions

**Settings › Security** is read-only. It states how people sign in and what governs it.

* **Methods.** Hosted SSO (WorkOS AuthKit) and Google. An email one-time code is the fallback: a 6-digit code that expires in 10 minutes.
* **Access.** Signing in requires a membership an admin created. "Access is granted by your workspace admin. There is no self-service signup."
* **MFA.** Quint does not enforce MFA itself. It inherits whatever your identity provider enforces.
* **Sessions.** Sessions last one hour. A tab that is actively loading data renews silently; an idle tab does not.
* **Removal.** Membership is re-read from the database on every authenticated call, so a removed member is refused immediately.
* **SCIM.** Directory provisioning over SCIM does not exist yet.
* **IP allowlisting.** Not available.

## Partner access

**Settings › Partner access** appears only when a partner holds standing access to this workspace or has a live delegated session. **Revoke access** ends standing access and **End now** ends a live session; otherwise the section reads "No partner holds access to this workspace and no partner session is open."

## If this fails

| What you see | What it means | What to do |
| - | - | - |
| The invitee says no email arrived | The address is wrong, or the mail was filtered | Check the address under **Pending Invitations**, then resend. |
| The invitation is more than 14 days old | It has expired | Click **Revoke Invite…** and invite the address again. |
| "Invitation declined" | The person declined the invitation; nothing was created | Invite them again if that was a mistake. |
| "No sign-in method is configured for this workspace. Ask your workspace admin to enable SSO, Google or email codes." | No sign-in method is set for this workspace | Sign-in methods are set with your Quint contact; see [Get support](https://docs.quintai.dev/help/get-support.md). |
| Your **Admin** role cannot change or remove an **Owner** | The member's current role is above your own | Ask an **Owner** to make the change. |
| **Manage Role** will not remove the last owner | "The last owner cannot be removed." | Transfer ownership first under **Settings › General**; see [Workspace, data region and retention](https://docs.quintai.dev/settings/workspace-and-data.md). |
| "Admin only — your role can view this setting but not change it." under **Feature visibility** | Your role is **Read** or **Policy Writer**: you can read the table but not change it | Ask an **Admin** or **Owner** to make the change. |

## Next

* [Roles and permissions](https://docs.quintai.dev/settings/roles-and-permissions.md)
* [Sign in](https://docs.quintai.dev/get-started/sign-in.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.