# Team and roles

Roles decide what each person on your team can do in your organization. Each
team member has one role: viewer, operator, or admin. Team members can create,
connect, and manage agents within what their role allows. You'll find the team
under **Team** in Settings.

## Roles

Catena has three roles, and each one includes everything the role before it can
do:

| Role     | Description                                                                                                                                                                                                                                                                                                        |
| -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Viewer   | Viewers can read everything in the organization, including balances, history, agents, and policies, and they can get deposit addresses. Viewers cannot change settings or move money.                                                                                                                              |
| Operator | Operators can do everything a viewer can. They can also create agents (without assigning a policy), add counterparties and their rails, and request payment details from a counterparty. Operators cannot send, transfer, approve, create or revoke [secret keys](https://docs.catena.com/connect/secret-keys.md), or change admin settings. |
| Admin    | Admins have full access. They can do everything an operator can, and they can also move money, approve, open and close accounts, write and assign policies, manage the team and settings, and complete [verification](https://docs.catena.com/fiat-access.md).                                                                               |

## Operators and admins

We recommend giving the operator role to someone who works with your accounts
through agents. Admins then decide what those agents may do through their
[policies](https://docs.catena.com/policies.md). For example, if Cora's Coffee has an agent that pays its
suppliers, an admin might give it a policy that allows sends only to Bea's Beans
and Pete's Packaging (its two suppliers), from one account, up to a set amount.

Only admins receive [approval](https://docs.catena.com/approvals.md) notifications (by email or Slack). If
someone needs to be notified when an approval is waiting, give them the admin
role.

## Invitations

An invitation will expire after three days. Note that a person invited at one
email address can join with a different verified address.

## Sessions

A console session will end after 15 minutes without activity, and we'll warn you
during the last minute.

## Related

- [Handle approvals](https://docs.catena.com/approvals.md): Learn what goes to the approvals queue, who can approve, when requests expire, and what happens between an approval and a completed payment.
- [Set policies](https://docs.catena.com/policies.md): Decide what each agent can do with its policy, from the accounts it can read and the counterparties it can pay to its spending rules and temporary overrides.
- [Link with secret keys](https://docs.catena.com/connect/secret-keys.md): A secret key lets an agent act in Catena from hosts where catena link cannot store a credential, such as CI jobs, cloud sandboxes, and deployed services.