Every member of a Nagata workspace has a role that controls what they can see and do.
The roles
| Role | Who it's for |
|---|---|
| Owner | The person who created the workspace; has full control |
| Admin | Trusted team members who manage the workspace day to day |
| Finance | Finance and procurement leads who approve decisions |
| IT | IT and operations staff who need read access |
| Viewer | Anyone who needs to see data but not take action |
Permission matrix
| Action | Owner | Admin | Finance | IT | Viewer |
|---|---|---|---|---|---|
| View all workspace data | ✓ | ✓ | ✓ | ✓ | ✓ |
| Upload spend / AI usage / contracts | ✓ | ✓ | ✓ | ✗ | ✗ |
| Edit vendor details | ✓ | ✓ | ✓ | ✗ | ✗ |
| Generate recommendations | ✓ | ✓ | ✓ | ✗ | ✗ |
| Approve / reject / complete recommendations | ✓ | ✓ | ✓ | ✗ | ✗ |
| Defer recommendations | ✓ | ✓ | ✓ | ✗ | ✗ |
| Generate and acknowledge alerts | ✓ | ✓ | ✓ | ✓ | ✗ |
| View audit logs | ✓ | ✓ | ✓ | ✓ | ✗ |
| Edit procurement policy | ✓ | ✓ | ✓ | ✗ | ✗ |
| Invite members | ✓ | ✓ | ✗ | ✗ | ✗ |
| Manage API keys | ✓ | ✓ | ✗ | ✗ | ✗ |
| Edit workspace settings | ✓ | ✓ | ✗ | ✗ | ✗ |
| Delete workspace | ✓ | ✗ | ✗ | ✗ | ✗ |
Changing a member's role
Role changes are currently handled by contacting support. A self serve role change UI is on the roadmap.
API integrations
If you're integrating Nagata via the API for an AI agent or automation, the integration uses an API key scoped to read only access. Sensitive actions (approve, reject, complete) always require a human.