Roles & permissions

Users belong to an organization, with one role each. Roles are set per organization, so being an owner of your own account says nothing about your role in a client’s.

The roles

Role	Can do
Owner	Everything, including billing, deleting the account, and changing other members’ roles. Every organization has at least one.
Admin	Everything operational — stores, reviews, loyalty, FAQs, galleries, widgets, email, API keys — but not billing or account deletion.
Member	Day-to-day work: moderating reviews, answering FAQs, curating galleries. Not connection settings or keys.

Ownership cannot be given up by leaving. If you are the only owner, promote someone before you remove yourself.

Only an owner can invite an owner, or deactivate or remove one. An admin can manage admins and members but cannot touch an owner. And nobody can deactivate or remove the last active owner: make someone else an owner first.

API keys have roles too

An API key is not a person, but it carries a role the same way, chosen when you create it. Keys can hold one more role than people can:

Role	Can do
Viewer	API keys only — the default for a new key. Read-only: it can read anything its scopes allow and change nothing. Any write request gets a 403 with the code role_read_only.

The role is the coarse limit and the key’s scopes narrow it further; a request has to be allowed by both. Pick the lowest role that does the job, then scope it to the resources the integration actually touches.

Belonging to several organizations

Your email address identifies you within an organization, not across all of Evident. The same address can be an owner of your own account and a member of three client accounts, with a different role in each.

Practical consequences:

• Signing in shows an account picker when your address matches more than one organization. Which one you land in is a choice, never an inference — Evident will not guess an organization from an email address.
• An invitation to a second organization is a new membership, not a transfer. Accepting does not affect the first.
• API keys belong to one organization and one store, never to you personally.

Inviting people

Settings → Team — invite by email address and pick a role. The invitation email comes from Clerk, our identity provider.

If an invite does not arrive, check Gmail’s Promotions tab before assuming it was not sent; that is where these tend to land.

Store-scoped access

Users who reach Evident from inside a BigCommerce or Shopify control panel, but who have no Evident user record, are signed in scoped to that store. They can work with that store’s data and nothing else — no organization settings, no billing, no other stores. This is deliberate: a staff account on a merchant’s platform should not inherit access to the merchant’s whole Evident organization by virtue of clicking an app icon.

To give someone full access, invite them properly under Settings → Team.

Partners and agencies

Agency and partner accounts have their own entitlement layer on top of roles, governing client handoffs, commissions and agency-managed billing. If you are running Evident across a portfolio, start with Managing client stores.

Auditing who did what

Two logs, and they answer different questions:

• Activity — what changed in the product: reviews moderated, settings edited, imports run.
• Security audit — who signed in, whose role changed, when a key was created or revoked.

See Activity & audit log.