Good project management roles and permissions give everyone access to what they need and nothing else, and they now have to cover AI too. In AlianHub that means four workspace roles, custom roles with dynamic permission rules, private projects and lists, and a clear rule for AI: it acts as a person and can never do more than that person can. This guide shows a setup that holds up as your team, clients and agents grow.
Key takeaways
- Start with four roles: Owner, Admin, Member and Guest. Add custom roles only when a real need appears.
- Use private projects and private lists for sensitive work, not separate tools.
- If a person cannot open a project, neither can their AI.
- No AI agent can change permissions or remove a member. Those actions do not exist for agents.
- Review access when people leave: revoke tokens and connected apps along with the account.
Why permissions matter more than they used to
A few years ago, permissions in a project tool were mostly about clients and contractors. Now there is a third kind of user: AI. Agents read tasks, write comments and propose changes. Connected AI apps act on behalf of a person.
That raises the stakes. A loose permission model used to mean a guest might see a budget field. Now it could mean an AI reads a whole project nobody meant to share. Getting roles right is the foundation for using AI safely.
The four workspace roles
AlianHub's Members page lets you invite and manage people with four roles:
| Role | Typical use |
|---|---|
| Owner | Runs the workspace. The instance owner is the only account that sees Settings > Instance |
| Admin | Manages members, settings and approvals |
| Member | Does the everyday work in their projects |
| Guest | Clients or outside collaborators with limited access |
There is no page where a person makes their own account. An owner or admin invites them, or the person installing AlianHub becomes the first owner.
Tip: keep the number of Owners small. Two is usually enough: one to run things, one as a backup who can get in if the first is away.
Custom roles and dynamic permission rules
Real teams rarely fit four boxes. AlianHub supports custom roles with dynamic permission rules, shown as a matrix. A common example is a Contractor role: allowed to work on tasks and log time, but not to see private lists or change project settings.
When to create a custom role:
- Contractors who need more than a guest but less than a member
- Finance staff who approve timesheets but do not manage projects
- Client leads who review work but should not see internal notes
Make roles for jobs, not for people. If you have a role named after one person, you will regret it when they change teams.
Private projects and private lists
Not everything belongs in a role. For a single sensitive project, like hiring or a board pack, use a private project or a private list. Access stays narrow without inventing a new role.
Several companies, one instance
If you run work for several companies, AlianHub can host them in one instance, each isolated. The app creates one database per company, so their data stays separate.
Sign-in, SSO and SCIM
Settings include Sign-in and SSO, SCIM, and Security and permissions. These let larger teams connect AlianHub to how they already manage identity.
How permissions apply to AI
This is where AlianHub is built differently. The rules for AI are simple and strict.
- Connected AI acts as you. When you connect Claude, ChatGPT or Claude Code over MCP, it sees what you can open and changes only what your role lets you change.
- Agents are members with limits. Each agent has an owner, a run budget and a role's permissions, minus anything destructive.
- Some actions do not exist for AI. No agent can delete a project or task, remove a member, change permissions or touch billing.
- Approvals respect permissions too. Whoever approves a waiting change in the AI Inbox must be able to open the same task and hold the same permission.
The consent screen adds one more layer. Read permissions are granted together, while wider ones like Manage tasks, Write docs and Read chat start unticked. A manage or chat permission works only when the app asked for it, you ticked it, and an owner or admin approved it for that app. Read the full flow in Connect your AI.
How to do this in AlianHub
- Open Settings > Members and invite people with the right role: Owner, Admin, Member or Guest.
- In Settings > Security & permissions, create custom roles for jobs such as Contractor.
- Mark sensitive projects or lists private.
- Under Settings > Agent clients, approve or deny each AI app and choose under Allow at most which permissions it may be given.
- In AI > Agents, set each agent's autonomy level and scope, and set a daily action limit and spend cap.
- For a sensitive project, set it to Propose everything so every AI change waits for a person, and choose its Agents and Done rule.
- Review AI > Audit log regularly, filtered by Gated actions or Refusals.
A business scenario: bringing clients and AI into one workspace
A consultancy wants clients to see progress, contractors to log hours, and AI agents to draft weekly status notes. Before, it kept a separate client board, a timesheet spreadsheet and a shared folder, and reconciled them by hand.
With guests for clients, a Contractor role for freelancers and agents scoped to delivery projects, everything lives in one place. Client-facing status drafts come from a Client Status Reporter agent and wait for the account lead. The consultancy spends less time copying updates between tools, clients get answers faster, and nobody worries that an agent will see an internal pricing note it should not.
Offboarding: the step people skip
When someone leaves, removing the account is not the whole job. Also:
- Revoke their tokens under AI > Accounts > My account, or have an admin revoke them.
- Check Connected apps and, as an admin, Settings > Agent clients.
- Reassign any agents they owned.
With a personal AI account, revoking the token ends the link.
FAQ
What roles does AlianHub have?
Four workspace roles: Owner, Admin, Member and Guest. You can add custom roles with dynamic permission rules, plus private projects and private lists.
Can an AI agent change permissions?
No. Changing permissions and removing members do not exist as agent actions, and a connected AI app cannot change who may do what.
Does a connected AI see everything in the workspace?
No. It acts as you, so it sees only the projects you can open and changes only what your role allows. Wider permissions need your tick and an admin's approval.
Can several companies share one AlianHub instance?
Yes. One instance can hold several isolated companies, each with its own database.
Map your roles before you invite the team. Explore roles in the live demo, see more on the features page, and share this with whoever owns access in your company.