# Workspace Roles

Every member of a workspace has exactly one role: **Owner**, **Editor**, or **Viewer**. The role applies to that workspace only - a user can be an Owner of one workspace and a Viewer of another.

## What each role can do

<table><thead><tr><th width="120">Role</th><th>What they can do</th></tr></thead><tbody><tr><td><strong>Owner</strong></td><td>Everything an Editor can, plus: invite members, change member roles, remove members, archive the workspace, promote another member to Owner.</td></tr><tr><td><strong>Editor</strong></td><td>Create, edit, and delete pages, blocks, and DAX queries. Embed Power BI content from the catalog. Use built-in AI agents and any custom agents shared in the workspace. Pin AI artifacts to pages.</td></tr><tr><td><strong>Viewer</strong></td><td>Read-only. Open pages, scroll, read AI conversations. Embedded Power BI reports stay interactive (filters, slicers, drill-throughs) because that interactivity is a Power BI client feature, not a Mosaic edit. Viewers cannot create pages, run agents in the workspace, or pin AI output.</td></tr></tbody></table>

## How roles are assigned

The workspace **Owner** assigns each new member's role when they invite them - see [Adding Members to a Workspace](/mosaic/user-access/adding-members.md). Roles can be changed any time after that:

1. Open the workspace
2. **Workspace settings → Members**
3. Click the role dropdown next to a member
4. Pick a different role
5. The change is immediate

## Multiple owners

A workspace can have more than one Owner. To promote an Editor to Owner, an existing Owner changes their role in the same way as above. Removing all Owners from a workspace is not allowed - you must always have at least one.

## Power BI access vs. Mosaic role

Workspace roles control what someone can do **inside Mosaic**. They do **not** override Power BI's own access model.

A Viewer in Mosaic who has Edit access to a Power BI workspace in Power BI itself can still interact with embedded reports normally. Mosaic does not grant or revoke Power BI permissions - every Power BI call goes through the user's own Microsoft Entra identity (the On-Behalf-Of flow).

This means:

* If a user has no Power BI access, they see "no access" on embedded blocks regardless of their Mosaic role.
* If a user has Power BI Pro / PPU access plus Editor role in Mosaic, they can interact with reports and write DAX queries the same way.
* Row-Level Security defined in Power BI is preserved end-to-end.

## Personal workspaces

Every user has one **personal workspace** that's auto-provisioned on first sign-in. They are the implicit Owner. Personal workspaces cannot be shared - they're for solo work. To collaborate, create a shared workspace and invite teammates.

## What's next

* [Adding Members to a Workspace](/mosaic/user-access/adding-members.md) - invite flow
* [User Login](/mosaic/user-access/user-login.md)  first sign-in walkthrough


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.aidi.ai/mosaic/user-access/workspace-roles.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.