The three roles
Member: everything in your company's workspace, scoped to your company. Members cannot change the UEI or CAGE code and cannot invite colleagues; Settings > Team tells them to contact an account admin.
Company admin: everything a member can do, plus inviting teammates as Member or Admin, changing the UEI and CAGE code, and approving or rejecting AI profile extractions for the company.
Platform admin: the operator role. It opens the admin console at /admin, triggers data syncs, trains models and manages platform keys. It is granted by the platform operator, not by a company admin.
Admin routes require a platform admin
Every /admin page checks the role on the server. A company admin who opens the console sees "The admin console is for platform admins" with a link back to the workspace, and any admin-only request answers 403 "Admin required". The same applies to sync and model-training buttons that may be visible to company admins: they call platform-admin routes and answer 403 for anyone else.
Inviting teammates
Settings > Team > Invite a Teammate takes a work email and a role. Invitations expire after 7 days, and an unaccepted invitation holds a seat against the team cap. If the email cannot be sent, the page shows the link to copy. The accept page asks for a name and a password and records the attestation.
Read-only seats
A read-only account can view every page in its company but cannot save. The refusal reads "This action is not available to read-only accounts", or on the teaming pages "Your role can view teaming partners but not change them."