Five roles. Right-sized permissions for every security team.

Owners and Admins share the same operational permissions — both can manage assets, scans, team members, and settings. The difference is billing authority: only the Owner can change the plan, update payment methods, cancel the subscription, or delete the workspace. This keeps the account holder in control of money and lifecycle decisions even when they delegate day-to-day administration.

Members are designed for developers and engineers who need to act on findings. They can comment on issues, mark findings as fixed or dismissed, and interact with the remediation workflow. Viewers are strictly read-only — they can see the same dashboards and data but cannot take any actions. Use Member for people fixing things; use Viewer for auditors, executives, and stakeholders.

No. Inviting users and changing roles is reserved for Owners and Admins. Managers focus on the security work itself: assets, scans, and findings. This keeps team composition changes auditable under a smaller set of privileged accounts.

Yes. Every action — invitations, role changes, asset edits, scan triggers, settings changes — is recorded with actor, timestamp, workspace, and outcome. The log is filterable by user and date, exportable for compliance, and retained for the life of the workspace so you can answer 'who did what, when' during SOC 2, ISO 27001, or internal reviews.

Yes. Workspaces are fully isolated — separate assets, scan schedules, findings, and team members. This is the standard model for MSPs managing client infrastructure, enterprises separating product lines, and agencies running engagements for multiple customers. Owners and Admins can hold cross-workspace visibility if needed.

Their access is revoked immediately, but their comments, assigned findings, and historical actions remain in the audit log under their name. You preserve the record of what they did without leaving them an active session. Pending invitations they created can be reassigned to another admin.

Yes. Owners and Admins can change any user's role at any time. Role changes take effect on the user's next action and are recorded in the audit log. Downgrading a Manager to a Member, for example, immediately removes their ability to edit assets while preserving their ability to work on issues they've already been assigned.

No. FortWatch doesn't charge per seat. Every plan includes unlimited Owners (one per workspace), Admins, Managers, Members, and Viewers. You pay for assets and scans, not for inviting your team — so there's no reason to leave your developers or compliance stakeholders outside the product.