# Who manages identity, membership and product access

Distinguish your personal security, organisation administration and local product permissions.

Source: https://help.smartfact.ai/manuals/accounts/roles-and-actions

Review edition: 25 October 2026

Roles: owner, author, reviewer, supervisor, operator, viewer, stores

Accounts identifies people and their organisations and grants access to enabled products. Each product then applies its own task permissions and local restrictions. Use this reference when a person can sign in but cannot do the expected work.

## Find the responsible person

| Task | Who | Additional conditions | Related guide |
| --- | --- | --- | --- |
| Accept your invitation and sign in | The invited person | Use your own email address and complete the offered identity checks. A pending invitation is not active membership. | [Sign in](/manuals/accounts/sign-in). |
| Change your password or enrol your authenticator | You, through your own account security page | Protect your recovery codes and follow the screen's confirmation steps. | [Security](/manuals/accounts/security). |
| Invite a person or manage another member's status and organisation role | Organisation administrator | Check the organisation and member identity. You cannot change your own organisation role or membership through the member editor, and an organisation must retain an active administrator. | [Manage access](/manuals/accounts/manage-access). |
| Choose another member's ordinary roles in an enabled product | Organisation administrator | Select roles for the work actually performed. Seat limits and enabled-product checks still apply. | [Manage access](/manuals/accounts/manage-access). |
| Use the offered Give me every role or Remove my roles controls | Organisation administrator, for their own ordinary product roles | These do not change the automatic Owner role or waive product review conditions. | [Manage access](/manuals/accounts/manage-access). |
| Grant or remove Owner in a product | Follows active organisation administration where that product supports Owner | Owner is not an ordinary role checkbox. It does not automatically authorise production work. | [Manage access](/manuals/accounts/manage-access). |
| Restrict site roles, remove local access or pair a station | The relevant product's Owner, through that product | Accounts grants do not override local site restrictions. Consult the product handbook. | [Access problems](/manuals/accounts/access-problems). |
| Approve a product release or resolve a production exception | The role required by that product | Organisation administration does not replace Reviewer, Supervisor or another working role. Consult the product's **Who can do what** guide. | The relevant product handbook. |
| Review subscriptions, evaluations, allowances and invoices | Active, accepted organisation administrator | Hosted billing must be enabled; product Owner alone is insufficient. Provider confirmation and employee grants remain separate. | [Review subscriptions, allowances and reported usage](/manuals/accounts/subscriptions-and-usage). |
| Change declared organisation retention settings | Active, accepted organisation administrator | Password and fresh two-factor confirmation; displayed units/bounds and product eligibility still apply. | [Choose the organisation retention policy](/manuals/accounts/retention-policy). |
| Register or revoke standalone hosted links | Active, accepted organisation administrator | Hosted registry, actual public key/key-id comparison, recent confirmation and permanent revocation consequences. | [Manage standalone installation links](/manuals/accounts/installation-links). |

## Diagnose access in order

Check your identity and active organisation membership first. Then check that the organisation has access to the product and that your own product roles are correct. If these are right, ask the product Owner about the local site assignment or removal state. Read a plan or allowance refusal separately from a missing-role refusal.

Do not give somebody all roles merely to remove a refusal without understanding it. A role combination can allow both authoring and review pages, while the product still requires a different person for the particular approval.

## Worked access handover

Sam can sign in to Accounts but cannot print in LabelRules. Sarah, the organisation administrator, checks Sam's membership and LabelRules working-role grants. If the Operator grant is absent, Sarah assigns the appropriate role subject to the product's seat allowance.

Sam reopens the product using his own identity. If access is still refused, the LabelRules Owner checks the site's local assignment. If access succeeds but the job is held for uncertain output, the handover goes to a Supervisor under the LabelRules procedure. Increasing Sam's roles does not establish whether the label printed.

This is an illustrative diagnostic sequence, not a claim that every print refusal is caused by access. Keep the actual message, product, organisation and task reference with the handover. Never include passwords, authenticator secrets or recovery codes.