TskVlo uses a role-based permission system at the workspace level, refined per member with board and wiki restrictions. Everything below lives in Workspace settings (gear icon in the sidebar) and requires the Owner or Admin role.
Roles Overview
| Role | Create, Edit & Delete Items | Manage Boards | Manage Members | Workspace Settings & API Keys |
|---|---|---|---|---|
| Owner | ✅ | ✅ | ✅ | ✅ |
| Admin | ✅ | ✅ | ✅ | ✅ |
| Member | ✅ | ✅ | ❌ | ❌ |
| Viewer | ❌ | ❌ | ❌ | ❌ |
The Owner is the workspace’s creator and can’t be removed or demoted.
Inviting Someone to a Workspace
- Go to Workspace settings → Members & roles.
- Click Invite member.
- Enter one or more email addresses — press Enter or comma after each.
- Choose their role: Viewer, Member, or Admin, and optionally add a personal note.
- Click Send invite.
They receive an email with a link to join. They can also sign up if they don’t have an account yet. Until they accept, they’re listed as Invited, and you can revoke the invitation with the delete icon.
Changing a Member’s Role
- Workspace settings → Members & roles.
- Pick the new role from the dropdown in the Role column.
Changes take effect immediately.
Restricting a Member to Selected Boards
For contractors or clients who should only see one or a few boards:
- Workspace settings → Members & roles.
- In the Board Access column, click the member’s button (it shows All boards by default).
- Turn on Restrict Access and select the boards they may see.
- Click Save.
The member now only sees the selected boards in the sidebar and the workspace views. Their role still decides what they can do on those boards: a restricted Viewer can only read, a restricted Member can edit.
Controlling Wiki Access
Next to the board access button, every member has a Wiki access checkbox. Untick it to hide the workspace wiki from that member — including wiki pages in search results — without touching their board access. It’s on for new members by default.
Removing a Member
- Workspace settings → Members & roles.
- Click the delete icon at the end of their row.
The member immediately loses access to all boards in that workspace. Their contributions (comments, time logs) remain.
API Keys and AI Connections
Integrations and AI assistants don’t get a role — they get an API key or an approved OAuth connection, both bound to a single workspace.
- API keys: Under Workspace settings → API keys, click Create key, name it, and choose Read & write or Read-only. Read-only keys can’t change anything, and AI assistants using them don’t even see write tools. You can see when each key was last used and revoke it there at any time.
- OAuth connections: When an AI client like Claude connects via OAuth, the person connecting must be an Owner or Admin. They pick the workspace on the consent screen and can tick Grant read-only access. If they later lose the Owner or Admin role, the connection stops working. To end a connection yourself, remove the connector in the AI client.
The MCP setup guide covers both in detail.
Storage Usage
Every member — not just Owners and Admins — can open Workspace settings → Storage to see how much of the workspace’s storage quota is in use. Uploads stop once a workspace exceeds its quota.
Best Practices
- Give clients the Viewer role and restrict them to their own board — full visibility where it matters, nothing else.
- For external contractors who only work on one board, use the Member role with a board restriction rather than full workspace access.
- Untick Wiki access for guests if your wiki holds internal documentation.
- Promote members to Admin only for team leads who need to manage the workspace, its members, and its integrations.
- Use read-only API keys or OAuth connections for reporting and AI assistants that only need to look things up.