Team membership is how Atmos Pro decides who can review plans, approve changes, and act on workflow alerts in a workspace. Anyone who pushes code to a connected repository is visible to Atmos Pro as a committer, but only people who have been invited and accepted are members — and only members can take action inside the app.

Three concepts to keep straight:

Licensed Users determine whose actions Atmos Pro acts on. Today this commonly means commits, approvals, merges, and workflow activity from authorized GitHub users. View-only dashboard users, auditors, and business stakeholders do not consume a license. Bot commits are exempt from this rule and are always processed. This is the economic link between licenses and your plan: your Licensed User count is the cap on how many human users can affect infrastructure through Atmos Pro.

When Atmos Pro detects committers on your repos who aren't yet members, it surfaces them in the workspace Recommendations panel as a nudge to invite them. The recommendation clears automatically once they're invited or excluded.

Workspace roles, Licensed User seats, and GitHub permissions answer different questions:

Viewer and Auditor are unlimited read-only roles and do not require a Licensed User seat. Member, Admin, and Owner are interactive roles: allocate a seat to people using them. Individual endpoints enforce their action permissions; allocating a seat does not turn a Viewer or Auditor into an interactive role. A workspace's feature entitlements, GitHub repository access, and MCP token scopes remain independent requirements.

Auditor is for inspecting controls and customer-visible audit evidence without permission to change those controls. Use Workspace Settings for the read-only control inventory and Audit Log for events. Repository settings show an inspection view. GitHub Environment reviewer rules and branch protections remain managed by GitHub and require separate GitHub access to inspect there.

Read-only describes actions, not confidentiality. Viewer and Auditor access includes plans and workflow logs available in the workspace, which can contain infrastructure details or sensitive values. Do not grant either role when the person should only see sanitized status summaries; a separate summary-only role or per-member repository visibility policy is not provided by these roles. Do not rely on every log or plan value being automatically redacted.

Neither Viewer nor Auditor can manage workspace credentials or read another user's private AI chats. Existing badge URLs are readable and designed for README embeds. A badge token grants only repository drift-status badge access; anyone holding the URL can view that status. Creating, rotating, and revoking badge tokens requires an Admin or Owner. Audit access excludes internal billing operations. MCP control inventories and badge-token listings honor the token's repository restrictions; a token scope never grants missing role permission. Workspace roles do not themselves define a per-repository membership allowlist.

A workspace must retain at least one Owner. Plan entitlements, repository permissions, and environment approvals may restrict an otherwise permitted action. See Repository Permissions for CI authorization.

Promoting a Viewer or Auditor to Member, Admin, or Owner assigns a Licensed User seat (except for exempt staff). Demoting to Viewer or Auditor releases their seat and prevents future automatic reassignment. Switching between Viewer and Auditor does not assign a seat. Role and seat changes commit together: if no seat is available or the seat change fails, the previous role and seat remain unchanged. Add seats from Billing before retrying a promotion.

When all seats are in use, Atmos Pro discards an affected batch from an unlicensed author and does not dispatch component workflows. For an unassigned author, assign a seat on the Team page, or add capacity in Billing so the next affected batch can assign one. For a revoked author, an admin must explicitly reassign the seat on the Team page; increasing capacity alone does not restore it. Then push again. A discarded batch is not a paused batch waiting to be released.

A Viewer or Auditor cannot initiate affected infrastructure workflows, even if a seat was assigned separately. An admin must change their role to an interactive role and assign a seat before retrying.

A documentation-only change with no affected components completes successfully without consuming a seat, even when the author has a revoked seat or the workspace is at capacity.

Licensing discards appear in the batch status comment and failed check, without a duplicate changes-requested review. After a successful retry, the status reflects the new batch. Older licensing reviews, posted before this behavior changed, are marked resolved after a successful retry.

Click your role badge in the account menu to open Your permissions, which shows your current workspace role, capabilities, license status, and detailed role grants.

Use list_my_permissions for your current role, role permissions, the role/token permission intersection, repository restrictions, and read-only license status. This diagnostic never assigns a seat. An Auditor, Admin, or Owner can use list_team_members to inspect members' roles, GitHub identities, and license states. list_entitlements reports the plan resolved for the workspace, including organization plans and overrides.

Viewer and Auditor MCP access is read-only: issue and pull request writes, comments, review requests, approval-plan dispatch, drift remediation, and PDF artifact creation are blocked. Audit diagnostics require audit-read permission, and team inspection permits Auditors, while repair administration tools retain their admin checks. Use get_workspace_controls to inspect settings and repository control configuration without edits, including security and AI settings, setup status, webhook delivery metadata, active MCP client grants, and Trust Center share-link lifecycle. The Auditor dashboard exposes the same information under the corresponding Workspace Settings tabs. The MCP Clients tab links to client installation; connecting an Auditor account grants read-only access. Owners and Admins alone can revoke workspace clients. This inventory excludes webhook credentials and destination URLs, OAuth token values, and private Trust Center access links.

A token scope does not override a missing workspace permission. Reauthorizing a Viewer token with audit-read scope does not grant access to audit records. For a permission denial, ask an admin to review the role; for a licensing denial, review the seat; for a GitHub denial, review repository access.

Owners and Admins can invite teammates from the Team page in workspace settings.

Invitations are delivered by email and are GitHub-authenticated — the invitee signs in with GitHub, and the email on their GitHub account must match the address you invited. This match acts as a second factor: someone who intercepts an invitation link cannot accept it unless their GitHub account already controls the invited email. There are no separate passwords to manage.

Pending invitations remain valid until accepted, revoked, or expired. You can resend or cancel them from the Team page.

Owners and Admins can change a member's role at any time from the Team page. Promotions and demotions take effect immediately on the member's next page load. A workspace must retain at least one Owner — the last Owner cannot demote themselves until another Owner is in place.

To remove a teammate, open the Team page, find the member, and choose Remove. Removing a member:

A removed member can be re-invited later. If they were the last Owner, you must promote another member to Owner first.

The "Invite N committers to Atmos Pro" recommendation appears whenever Atmos Pro sees commits from users on connected repos who aren't yet members. The card lists who they are, links to the Team page so you can invite them, and disappears once everyone listed has been invited or excluded. It's a low-priority suggestion, not a warning — you can ignore it indefinitely if those committers shouldn't have access to the app itself.