Every person in a workspace has exactly one role. The five roles, from most to least privileged:

​
Permission matrix

* Execution Plane submission checks workspace membership; the QCOS proxy additionally enforces the role, and viewer is limited to read-only there. Give read-only users the viewer role and do not share sq-live- keys with them — an API key always acts as its owning user. Rules worth knowing:
  • Admins cannot touch owners. An admin can manage every other role but cannot remove or demote an owner; only an owner can grant owner.
  • API keys inherit the owner’s role. A sq-live- key authenticates as the user who created it, in that user’s workspace, with that user’s role. Scopes selected at key creation are stored for audit, but on the platform’s execution routes authorization comes from the workspace role — treat the key like the user’s own login.
  • Instance access groups. A quantum instance can be open to all_members, restricted to owners_only (owner + admin), or to a custom list of members.
  • Pay-as-you-go approval is not a workspace role. Enabling paygo on a quantum instance requires approval by SoftQuantus staff against a contract reference — see Quantum instances.

​
Where to manage roles

Team management lives in the console under Workspace → Team: invite by e-mail, pick a role, change it later. See Workspaces & team for the full walkthrough and Billing for the operations gated to owner/admin.