Team & Roles
A Hober workspace is operated by a team: each member has a persona role matching how teams actually divide the work. Manage everything under Settings → Team.
The five roles
| Capability | Owner | Admin | Developer | Marketer | Analyst |
|---|---|---|---|---|---|
| Read everything (campaigns, segments, analytics, settings) | ✅ | ✅ | ✅ | ✅ | ✅ |
| Compose, schedule, and cancel campaigns; segments, journeys, templates | ✅ | ✅ | — | ✅ | — |
| API keys, channels, webhooks, integrations | ✅ | ✅ | ✅ | — | — |
| Team management (invite, change roles, remove) | ✅ | ✅ | — | — | — |
| Billing & plan (view) | ✅ | ✅ | — | — | — |
| Billing & plan (change plan, payment methods) | ✅ | — | — | — | — |
| Agent applications (MCP) & agency operate-as | ✅ | ✅ | — | — | — |
| Transfer ownership | ✅ | — | — | — | — |
- Developer is for the people integrating SDKs and backends — full credential and channel access without the ability to message your real audience.
- Developer sees subscriber records with PII redacted: email local parts are masked (
a•••@example.com) and attribute values replaced with•••— external IDs and attribute keys stay visible for debugging registrations. - Marketer runs the messaging — without access to credentials, billing, or the team.
- Analyst sessions are read-only end to end: every write is rejected, not just hidden.
- There is exactly one owner — the person who registered the workspace. Ownership moves only via Transfer ownership (Settings → Team, on an admin's row).
Inviting teammates
- Settings → Team → Invite a member, pick the role.
- Copy the generated link — it is shown once, is single-use, has the role baked in, and expires after 7 days.
- Send it however you like; the recipient creates their account at the link and lands directly in your workspace with the assigned role.
Pending invitations are listed with a revoke button. Anyone with the owner or admin role can invite; nobody can be invited as owner.
Changing roles and removing members
Role changes and removals take effect immediately — the member's active sessions are revoked and their next sign-in (or token refresh) carries the new role. You cannot change your own role or remove yourself; ask another admin.
Single sign-on
Workspaces on SAML (Enterprise) can map an IdP attribute to the role. Values are normalized onto the five personas; anything unrecognized becomes analyst (least privilege), so a misconfigured IdP can never over-grant.