Invite or permission denied errors explained
Why invites fail or teammates see permission denied: wrong email, role keys, missing workspace permissions, or owner-only account actions.
permission denied and invite failures are almost always role configuration or invite email mismatch — not a product outage.
What it is
A reference for invite problems and runtime permission denials in the app/API.
Common causes
- Invite email mismatch — User signed up with a different address than the invite.
- Invite expired / already accepted — Resend a fresh invite from workspace team settings.
- Role missing the permission — Workspace role lacks the key for that screen (for example keyword.update, report.run).
- organization-owner action — Billing, role CRUD, notification templates, whitelabel are org owner only — cannot be granted on workspace roles.
- Wrong workspace — User switched to a different client workspace without membership.
- Dependent permissions — Some writes need both read and update pairs.
Where to check
- Organization settings → Roles (owners)
- Workspace team membership and pending invites
- Audit logs for access changes when available
Related how-tos
- Troubleshoot permission denied for a teammate
- Assign a role when inviting
- Permission denied errors — which key was missing