Roles
5-role hierarchy (see Roles & Permissions for the full matrix):Creator and Analytics roles were renamed in #1865. If you see these in older references, they map to Manager (Creator) and Viewer (Analytics).
Inviting a team member
Open Team Members
Organisation Settings -> Team Members.
Click Invite
The Invite button is visible to Managers and above (#1946 — requires
update permission on the Team subject).Enter email + role + scope
Email + role + org-wide or community-scoped. Picking a community limits that member to seeing that community’s content.
Send invite
Nudj emails an invite link. The recipient signs in and is auto-assigned the role.
Role scope
Roles are either org-level (see everything) or community-scoped (see one specific community):Per-user tokens
Each member has a personal access token (#1816) used for admin API calls and scripted automation. Managers and above can view their own token; Admins can revoke any member’s token. Token revocation signs the member out immediately everywhere.RBAC enforcement
Roles are enforced at two layers:- Client-side (#1864) — UI hides buttons/fields the member can’t use. Nav links don’t show for subjects they can’t read.
- Server-side (#1875) — every API call validates the role against the subject + action. Client-side restriction is UX; server-side is security.

