Every member of a Nagata workspace has a role that controls what they can see and do.
The roles
| Role | Who it's for |
|---|---|
| Owner | The person who created the workspace; has full control |
| Admin | Trusted team members who manage the workspace day-to-day |
| Finance | Finance and procurement leads who approve decisions |
| IT | IT and operations staff who need read access |
| Viewer | Anyone who needs to see data but not take action |
Permission matrix
| Action | Owner | Admin | Finance | IT | Viewer |
|---|---|---|---|---|---|
| View all workspace data | ✓ | ✓ | ✓ | ✓ | ✓ |
| Upload spend / AI usage / contracts | ✓ | ✓ | ✓ | ✗ | ✗ |
| Edit vendor details | ✓ | ✓ | ✓ | ✗ | ✗ |
| Generate recommendations | ✓ | ✓ | ✓ | ✗ | ✗ |
| Approve / reject / complete recommendations | ✓ | ✓ | ✓ | ✗ | ✗ |
| Defer recommendations | ✓ | ✓ | ✓ | ✗ | ✗ |
| Generate and acknowledge alerts | ✓ | ✓ | ✓ | ✓ | ✗ |
| View audit logs | ✓ | ✓ | ✓ | ✓ | ✗ |
| Edit procurement policy | ✓ | ✓ | ✓ | ✗ | ✗ |
| Invite members | ✓ | ✓ | ✗ | ✗ | ✗ |
| Manage API keys | ✓ | ✓ | ✗ | ✗ | ✗ |
| Edit workspace settings | ✓ | ✓ | ✗ | ✗ | ✗ |
| Delete workspace | ✓ | ✗ | ✗ | ✗ | ✗ |
Changing a member's role
Role changes are currently handled by contacting support. A self-serve role-change UI is on the roadmap.
API integrations
If you're integrating Nagata via the API for an AI agent or automation, the integration uses an API key scoped to read-only access. Sensitive actions (approve, reject, complete) always require a human.