Every person in a Wetel workspace is either an owner or a member. Members can build and run AI employees; only owners can do the sensitive things: decide approvals, read the approvals inbox, and hire a role into the workspace.
Think of a small office. Everyone has a desk key and can do their job. Only the office manager signs off on refunds and signs new hires’ contracts. The AI employees in the workspace work under the same arrangement: a person, the owner, holds the signing pen.
What can only an owner do?
These are the operations the docs mark as owner-only:
- Read the approvals inbox and open a single request (
approvals,approval). - Approve or reject a paused step (
decideApproval), and withdraw a pending request (cancelApproval). - Receive approval notices: when a request opens, every active owner gets an in-app “Approval needed” notification, and the live inbox updates (
approvalOpened,approvalDecided) are owner-only too. - Hire a role into the workspace (
hireAgentTemplate), on a PRO plan for now. - Finish a hired role’s setup by giving a credential for a waiting step (
provideAgentTemplateSlotCredential).
API keys cannot decide approvals. A decision always needs a signed-in owner.
Why is the approvals inbox owner-only?
Because a request carries the thing being decided (an order, a draft refund), and that may contain customer data.
What can a member do?
Everything else a signed-in dashboard user can do. A dashboard login gives access to build: create and update agents, workflows, knowledge bases and connectors, and generate API keys, and the docs list no owner requirement for these. A member can also browse the roles that are available to hire; being an owner is checked at the moment of hiring, not when browsing.
How is the owner decided?
The person who created the workspace is an owner. For a workspace that belongs to a company account, the owner of that company account is an owner, set when they sign in. Everyone else is a member.
Each user’s role is readable on their profile as tenantRole (OWNER or MEMBER). The field is read-only, so it is not something you set through the API, and the server checks it again on every owner-only call rather than trusting an earlier answer.
Can there be more than one owner?
Yes. The docs speak of “every active owner”: approval notices go to all of them, and any one of them can decide. The first decision is final; a second attempt on the same request is refused with a message naming who decided and when.
Is there an approver or reviewer role?
Not today. The approval node has an approverRole setting, and OWNER is its only value. There is no separate approver, reviewer or read-only role, and no finer-grained permissions inside a workspace: two roles, owner and member.
If you need a different person to sign off a step, today that person has to be a workspace owner.
What is live, and what is not?
Live today:
- Two roles per workspace, owner and member, readable on each user.
- Owner-only approvals: the inbox, decisions, cancelling, notices and live updates.
- Owner-only hiring of a listed role (PRO plan for now). Nothing appears to hire until Wetel lists a role, so today it is available by invitation.
Not built yet:
- An approver role other than owner, or any finer-grained customer role.
- Email notices for approvals. Notices are in-app only.
For more on what an AI employee should be allowed to do without a person, see supervised or autonomous, and for the expiry case, what happens when nobody approves in time.
Related reference docs
getAuthProfile: the user object, includingtenantRole- Approval node:
approverRole, the owner-only operations and their errors - Human approval: a walkthrough: building, testing and deciding an approval end to end
hireAgentTemplate: hiring a role, who may do it, and the limits- Authentication: what a dashboard login, an API key and a session token each unlock
If you are working out who in your team should hold the owner role, tell us which work you’d hand over first.