# People and access > Who acts in your organization, where work lives, what roles allow, and how Continual's agent acts with exactly the access of whoever it works for. Your organization is your business in Continual. Everyone and everything that acts in it is an **actor**, and each actor's **roles** decide what it may do, and where. Continual's agent works under the same rules as everyone else. ## Who acts | Actor | What it is | Example | | ------------------- | ------------------------------------------------------------------- | ------------------------ | | **Member** | A person in your organization | Ana, an accountant | | **Service account** | An actor that is not a person, of kind **Agent** or **Integration** | Continual; a GitHub sync | You sign in once, with Google, as a **user**. You can belong to several organizations, and in each one you are a member. Roles go to members, never to users. A member moves through these statuses: Only active members work in the organization. An invited member can own work before they first sign in. A suspended member loses access but keeps their roles. Continual's agent has its own service account, which every organization gets with the Agent app. Each app's automations also run as service accounts of their own, so every change names who made it. ## Where work lives Every record lives somewhere, and records form one tree under your organization. A role given at one place reaches the records under it. | Place | What lives there | Private | | -------------------- | -------------------------------------------------------------------------------------------- | ------- | | **The organization** | Each app's records, such as deals and invoices; companies, people, products; shared settings | No | | **A project** | Its tasks, and the comments and to-dos on them | Yes | | **A saved view** | Its filter, sort, and columns | Yes | | **Your own work** | Your threads with Continual, your mail, your memory and settings | Yes | A **private** place stops roles from above. An organization admin sees that a project exists, and its name, but not the tasks inside it, until someone shares the project with them. Whoever starts a project or saves a view owns it, and shares it from **Share…** in its **⋯** menu. Your own work is yours alone. ## Roles A **role** is a set of permissions, such as reading invoices or issuing them. You give a role to an actor, or to everyone in the organization, at one place, and it reaches everything under that place. ### Organization roles | Role | What it allows | | ---------- | ---------------------------------------------------------------------------------------- | | **Member** | Work on what everyone shares: companies, people, comments, to-dos, settings you may read | | **Admin** | Manage people, service accounts, apps, the domain, and who holds which role | Every member holds **Member**, given once to the whole organization. The person who creates the organization is also its admin. An organization always keeps at least one active admin. An admin sees an app's records only with one of the app's roles, which an admin may give themselves. ### App roles Each app brings its own roles when you install it. | App | Role | Given to | Allows | | -------- | --------------------------------- | ------------------------- | ------------------------------------ | | Sales | **Member** | Every member | Work deals, quotes, and orders | | Projects | **Member** | Every member | Start projects and see shared work | | Projects | **Owner**, **Editor**, **Viewer** | People on one project | Manage, change, or read that project | | Finance | **Accountant** | Only who an admin chooses | Keep the books, issue invoices | | Finance | **Finance viewer** | Only who an admin chooses | Read the books and change nothing | Roles given to every member never reach service accounts. A service account, Continual's included, holds only the roles an admin gives it. Give and take roles in **Settings › Members**. ### How permissions add up - **Roles only add.** Each role grants more, and none takes anything away. - **To point at a record, you must be allowed to link to it.** Naming a customer on an invoice needs access to that customer. - **What you write is yours.** Only the author changes or takes back a comment or a reaction; admins cannot. - **Every change to access is recorded,** like every other change. Approvals come after access: they decide which allowed changes wait for a yes, and never grant anything a role does not. See [approvals](/docs/concepts/approvals). ## How the business is organized **Coming.** A business has three structures, and Continual keeps them apart, so a reorganization never moves an invoice or rewrites the books: | Structure | Answers | In Continual | | ------------ | ------------------------------------------- | ------------------------------------------------------------------ | | **Teams** | Who works together on what? | Teams hold their work and roles; your organization is the top team | | **Entities** | Which legal company signs, owns, and files? | Each legal entity keeps its own books, invoices, and payments | | **Managers** | Who answers to whom? | A manager on each person, used to route approvals | - **Teams** nest, and members of a team see the work of the teams under it. A team gives its roles to its members, agents included, and keeps its own processes, projects, and settings. - **Entities** are where the documents that post live, so an accountant can be given the UK entity's books and nothing else. Companies, people, and products stay shared across the organization. - **Groups** hold roles for people and agents who cut across teams, such as everyone who approves payments. - **Cost centers and departments** are details on each ledger entry, never places, so moving a team never restates past numbers. A new organization has one entity and one team, your organization itself, and you never see either until you add a second. ## Acting on someone's behalf Continual's agent always works **on behalf of** an actor. When it works for you, it reaches what you reach, and nothing more, and its own authority caps what it does alone: by default, it drafts and changes freely, asks before it finalizes, sends, pays, or deletes, and never changes who has access. See [approvals](/docs/concepts/approvals#authority-how-much-anyone-may-do-alone). The same rule holds for anyone acting for someone else, such as an assistant working in an executive's mail: their access, capped by the assistant's own authority. Only Continual's own system can let an agent act for people. An admin cannot create an agent that reads your mail. Every change records who made it, for whom, and why: "Continual, for Ana, from her request". See [activity](/docs/concepts/activity). Coming: you give Continual your consent to act for you, and can take it back at any time. Continual also works for service accounts, such as **Finance collections**, with only that account's roles, directed by the people who operate it. Work a person sets running, such as a watch, runs on their behalf, and pauses if they leave until an admin gives it a new owner. ## Remove someone Suspending a member keeps their roles and work, and they can be reactivated. Removing a member deletes their own work: their threads with Continual, their memory, and their personal connections. Shared records they created, such as deals and invoices, stay with the organization. ## Join by email domain If your company uses Google Workspace, an admin can claim its domain under **Settings › Members › Google Workspace domain**. Colleagues then see the organization when they sign in, and choose to join it without an invitation. - A domain belongs to only one organization. - Continual claims a domain only from Google's verified Workspace domain, never from an email address alone. - Signing in never adds anyone by itself. What waits for a yes, and who gives it. Add people and give them roles.