# Team, roles & access

### Members (Firm settings → Team Members, or `/organization`)

Admins/owners see the member list (name, email, role) and can:
- **"Invite member"** — enter an email and pick a role; the invitee gets an email link. Pending
  invitations can be **Resent** or **Canceled**.
- **Approve / Decline join requests** from people who requested to join.
- **Remove** a member (with confirmation — they lose all access).

### Roles & access (Firm settings → Roles & access)

Access is governed by **roles**, and permissions attach to roles, not people.

**Built-in roles:** **Owner** (locked — always every permission and every case), **Admin**,
**Member**. These show a "Default" badge, and "Customized" if changed; a customized system role
can be **reset to default**.

**Creating a role** (needs the "manage roles" permission) — **"+ New role"** opens an editor:
- **Name**, **Description**, **Color**.
- **Permissions**, grouped (Members, Documents, Chats, Cases, Roles, …), each with select-all.
- **Case access**:
  - **All cases** — sees every case, including future ones.
  - **Specific cases** — only the cases you pick (searchable list); everything else is hidden.
  Firm-managing roles are always "All cases."

Assign a role to a member from the **Team Members** list. Custom roles can be edited or deleted;
members on a deleted role need reassignment.