> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://tieback.io/docs/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://tieback.io/docs/_mcp/server.

# Tenancy, Roles & Members

> How tieback isolates each brand workspace, manages member invitations and roles, and enforces role-based access control across every read and write.

**tie*back***

is a multi-tenant platform. Every brand workspace is a fully isolated tenant: products, identifiers,
passports, audit records, API credentials, and billing state belong to a single workspace, and that
separation is enforced on every read and write.

## Access Model

Access is workspace-scoped and role-based. Permissions are applied per action rather than granted
wholesale, and the default posture is least privilege: a member can do what their responsibilities
require and nothing more.

The model rests on four principles:

* **Workspace-scoped access.** A member's access applies only inside the workspaces they belong to.
* **Role-based permissions applied per action.** Every read and write is authorised individually.
* **Least privilege by default.** New members start with the narrowest access that fits their role.
* **Full separation between workspaces.** No data, credential, or audit record crosses a workspace boundary.
* **An audit trail of who changed what.** Every access change is recorded.

Roles span ownership, administration, editorial, and approval responsibilities. A workspace always
has exactly one owner, and ownership transfer is atomic.

## Member Management

Workspace owners and admins manage members from **Settings → Roles**:

* Invite new members by email
* Assign or change roles
* Revoke access immediately
* Transfer workspace ownership atomically (a workspace must always have exactly one owner)

Each member with at least one active role inside the workspace counts as a billable seat. Removing a member frees the seat immediately.

## Platform Plane

A separate **platform plane** exists for **tie*back*** staff. Platform staff can:

* Investigate and support customer workspaces with full audit logging
* Manage carrier output profiles, market packs, and the field dictionary
* Operate the support console for incident response

Platform staff never consume tenant seats. Their actions inside a tenant are logged distinctly from tenant-member actions and are subject to the **no standing access** policy: break-glass interventions require time-bound, cryptographically logged approvals.

## Audit Log

Every role change, invitation, ownership transfer, and platform-staff intervention is recorded in the workspace audit log. See [Audit Log](/tenancy-governance/audit-log).

## Related Docs

* [Audit Log](/tenancy-governance/audit-log)
* [Plans & Subscriptions](/onboarding-plans/plans-subscriptions)
* [Security Architecture](/getting-started/security-architecture)