# People and access > Who acts in your organization, where work lives, what roles allow, and how Continual's agent acts with exactly the access of whoever it works for. Your organization is your business in Continual. Everyone and everything that acts in it is an **actor**, and each actor's **roles** decide what it may do, and where. Continual's agent works under the same rules as everyone else. ## Who acts | Actor | What it is | Example | | ------------------- | ------------------------------------------------------------------- | ------------------------ | | **Member** | A person in your organization | Ana, an accountant | | **Service account** | An actor that is not a person, of kind **Agent** or **Integration** | Continual; a GitHub sync | You sign in once, with Google, as a **user**. You can belong to several organizations, and in each one you are a member. Roles go to members, never to users. A member moves through these statuses: Only active members work in the organization. An invited member can own work before they first sign in. A suspended member loses access but keeps their roles. Continual's agent has its own service account, which every organization gets with the Agent app. Each app's automations also run as service accounts of their own, so every change names who made it. ## Where work lives Every record lives somewhere, and records form one tree under your organization. A role given at one place reaches the records under it. | Place | What lives there | Private | | -------------------- | -------------------------------------------------------------------------------------------- | ------- | | **The organization** | Each app's records, such as deals and invoices; companies, people, products; shared settings | No | | **A project** | Its tasks, and the comments and to-dos on them | Yes | | **A saved view** | Its filter, sort, and columns | Yes | | **Your own work** | Your threads with Continual, your mail, your memory and settings | Yes | A **private** place stops roles from above. An organization admin sees that a project exists, and its name, but not the tasks inside it, until someone shares the project with them. Whoever starts a project or saves a view owns it, and shares it from **Share…** in its **⋯** menu. Your own work is yours alone. ## Roles A **role** is a set of permissions, such as reading invoices or issuing them. You give a role to an actor, or to everyone in the organization, at one place, and it reaches everything under that place. ### Organization roles | Role | What it allows | | ---------- | ---------------------------------------------------------------------------------------- | | **Member** | Work on what everyone shares: companies, people, comments, to-dos, settings you may read | | **Admin** | Manage people, service accounts, apps, the domain, and who holds which role | Every member holds **Member**, given once to the whole organization. The person who creates the organization is also its admin. An organization always keeps at least one active admin. An admin sees an app's records only with one of the app's roles, which an admin may give themselves. ### App roles Each app brings its own roles when you install it. | App | Role | Given to | Allows | | -------- | --------------------------------- | ------------------------- | ------------------------------------ | | Sales | **Member** | Every member | Work deals, quotes, and orders | | Projects | **Member** | Every member | Start projects and see shared work | | Projects | **Owner**, **Editor**, **Viewer** | People on one project | Manage, change, or read that project | | Finance | **Accountant** | Only who an admin chooses | Keep the books, issue invoices | | Finance | **Finance viewer** | Only who an admin chooses | Read the books and change nothing | Roles given to every member never reach service accounts. A service account, Continual's included, holds only the roles an admin gives it. Give and take roles in **Settings › Members**. ### How permissions add up - **Roles only add.** Each role grants more, and none takes anything away. - **To point at a record, you must be allowed to link to it.** Naming a customer on an invoice needs access to that customer. - **What you write is yours.** Only the author changes or takes back a comment or a reaction; admins cannot. - **Every change to access is recorded,** like every other change. Approvals come after access: they decide which allowed changes wait for a yes, and never grant anything a role does not. See [approvals](/docs/concepts/approvals). ## How the business is organized **Coming.** A business has three structures, and Continual keeps them apart, so a reorganization never moves an invoice or rewrites the books: | Structure | Answers | In Continual | | ------------ | ------------------------------------------- | ------------------------------------------------------------- | | **Teams** | Who works together, in which jobs? | Teams and their positions; your organization is the top team | | **Projects** | What is the business delivering? | Projects nest, and each names the team responsible for it | | **Entities** | Which legal company signs, owns, and files? | Each legal entity keeps its own books, invoices, and payments | - **Teams** nest, and a role given on a team reaches the teams under it. A team keeps its own processes, connections, and settings. - **Positions** are the jobs in a team, such as AP manager or Developer. A position holds roles and authority limits, and one or many people, Continual, or equipment hold it. Being on a team means holding one of its positions. Each team has an **Owner** position, to which its approvals and problems go. - **Entities** are where the documents that post live, so an accountant can be given the UK entity's books and nothing else. Companies, people, and products stay shared across the organization. - **Projects** are a separate tree. A task books a position, such as two Developers for a week, and the team chooses who holds it, so a reorganization changes who works on a project, never the project. - **Cost centers and departments** are details on each ledger entry, never places, so moving a team never restates past numbers. A new organization has one entity and one team, your organization itself, with Owner and Member positions, and you never see any of it until you add more. ## Acting for someone Continual's agent always acts **for** someone. When it works for you, it reaches what you reach, and nothing more. Its own authority decides what it does alone: by default, it drafts and changes freely, and asks before it finalizes, sends, pays, changes who has access, or deletes. See [approvals](/docs/concepts/approvals#authority-how-much-anyone-may-do-alone). Only Continual's own system can let an agent act for people. An admin cannot create an agent that reads your mail. Every change records who made it, for whom, and why: "Continual, for Ana, from her request". See [activity](/docs/concepts/activity). **Coming:** - **You can turn it off.** Continual acts for every member, and you can stop it acting for you. - **Continual acts for positions,** such as AP agent, with that position's access and its team's, never a holder's own. The position's work runs the same way whoever holds it, and goes to the team's owner while the position is empty. - **Work moves; access stays put.** When Continual, acting for you, may not do something, such as pay a bill, it hands the request to the position that may, and your thread follows it. - **Work you set running,** such as a watch, pauses if you leave, until it gets a new owner. ## Remove someone Suspending a member keeps their roles and work, and they can be reactivated. Removing a member deletes their own work: their threads with Continual, their memory, and their personal connections. Shared records they created, such as deals and invoices, stay with the organization. ## Join by email domain If your company uses Google Workspace, an admin can claim its domain under **Settings › Members › Google Workspace domain**. Colleagues then see the organization when they sign in, and choose to join it without an invitation. - A domain belongs to only one organization. - Continual claims a domain only from Google's verified Workspace domain, never from an email address alone. - Signing in never adds anyone by itself. What waits for a yes, and who gives it. Add people and give them roles.