Teams & seats
A seat is a person in your tenant. Each seat carries one role, and that role travels with them into whichever assistant they connect. Invite someone as a Viewer and their Copilot is a viewer too, without anyone configuring Copilot.
Inviting someone
- Open Team. Only an Admin sees this section. If you cannot, ask whoever set up the tenant.
- Enter the email and choose the role. Pick the role before sending rather than fixing it afterwards. The invitee's first session will use it, and first sessions are where habits form.
- Send the invite. They receive a secure one-click link. Links expire after seven days; resend from the same screen if one lapses.
- They connect their own assistant. Nothing else for you to do. Their OAuth connection resolves to their seat, and their seat carries their role. See Connect your AI.
Seat limits
Seats are counted per plan, and pending invitations count against the limit as well as accepted members. That is deliberate: an invitation that has been sent is a seat that has been promised.
| Plan | Seats |
|---|---|
| Free | 1 |
| Starter | 5 |
| Business | 10 |
| Enterprise | Unlimited |
Full plan details, including call quotas and connector counts, are in limits and plans.
Seats are people, not agents. An unattended agent runs on an API key, and a key does not consume a seat. If you are near the limit because of automation rather than headcount, you may be using seats where you wanted keys. See build an agent.
Structuring a team
The shape that works is the one your organisation already has. Roles map to departments, not to an abstract permission hierarchy invented for the tool.
| Group | Role | Reasoning |
|---|---|---|
| IT / engineering | Admin | Someone has to hold connectors, keys and roles. Keep it to as few people as the organisation tolerates. |
| Finance | Finance | Financial systems, including the write tools that genuinely move money, scoped away from everything else. |
| Operations, Sales, Support | Manager, or a custom role | Their own systems, read and write. A custom role is right when "their own systems" is narrower than the built-in Manager scope. |
| Analysts, auditors, contractors | Viewer | Read only. Nothing they can do can change the business. |
When someone leaves
Removing a seat is the whole job for anything that person connected with OAuth. Their assistant connections resolve through the seat, so revoking it revokes their access everywhere at once.
- Remove the seat under Team. Their OAuth-connected assistants stop working immediately.
- Check for API keys they created. Keys are not tied to a seat. A key that person generated keeps working until it is revoked, under Settings → API Keys.
- Look at the audit log. Confirm nothing is still arriving under their name or their keys. If it is, something automated is still using their credential.
This is the step that gets missed. Removing the seat does not revoke API keys that person issued, by design, since an unattended job should not break because its author changed employer. It does mean offboarding has two steps rather than one.
Changing someone's role
Change it on the seat and it applies to their next request. There is no reconnection, no new invite and no need for them to remove and re-add their assistant. If they had a tool a moment ago and no longer do, tool discovery reflects that the next time their assistant refreshes.