Invite a second person
A workspace of one cannot approve anything. Publishing a policy, approving a beneficiary change, approving a payout above the threshold: each needs a person other than the one who asked. Inviting a second stakeholder is also one of the seven activation criteria.
Click any step to read what happens there and what can refuse it.
Which role to give
| You want them to | Give |
|---|---|
| Approve policies, beneficiary changes, payouts and appeals, and release payouts, but never draft, connect or send traffic | approver |
| Draft policies, run reports, work cases and the reconciliation queue | analyst |
| Integrate: connect providers, mint keys, manage webhooks, send traffic, create payouts | developer |
| Everything | admin or owner |
| Only look | viewer |
The separation is what makes dual control meaningful by role as well as by identity: an approver cannot request a beneficiary change, and a developer cannot approve one.
The account-takeover rule applies to them too
Enrolling a second factor counts as a credential change. For 24 hours afterwards, the new member cannot request or approve a beneficiary change (ato_session_blocked). Invite approvers before you need them.
Changing or removing a member
In Settings → Team, each other member has a role selector, Change role, and Remove from workspace. Both ask for a fresh second factor. An invitation that was never accepted stays listed under Invitations outstanding until it expires.