​

Team & permissions

Team & permissions is the Manage Team workspace, a single-page surface that lists current members in one table, lists pending invitations in a second table below, and exposes an invite affordance gated by a Salesforce-prerequisite walkthrough. Three roles (admin, manager, member) gate what each teammate can see and do across the rest of the product, and the page itself is gated to admins and managers; plain members hit an Access Denied card.

​

What you can do here

• See the team as a member table. Each row shows the avatar plus name, the email address, a Role dropdown, and an Actions cell. Admins, managers, and members render in the same list, but admin rows lock the role dropdown and hide the Remove button so an admin is never accidentally demoted or removed from this UI. Promotion to admin is intentionally not exposed; admins are seeded through the org-creator flow.
• Promote or demote between Manager and Member. The Role dropdown on any non-admin row exposes Manager and Member. Picking a new role writes to the identity provider, mirror-writes to the shared store so cross-surface filters (Mine / All on Opportunities, the per-rep Pipeline Hygiene drill-in, manager-only Pipeline Hygiene rule edits) see the new role immediately, fires a confirmation toast, and reloads the page so every other surface re-mounts against the new permissions.
• Remove a teammate. The Remove button on a non-admin row fires a browser confirm, then removes the user from both the identity provider and the shared store. The reload pattern is the same as role change; the page refreshes after the write so no surface is left running against a stale membership.
• Invite a new teammate with the two-step walkthrough. Invite Member in the page header opens a Before You Invite Salesforce-prerequisite dialog first, then the actual invite form. The prerequisite dialog walks the admin through enabling “Approve Uninstalled Connected Apps” on the invitee’s Salesforce user (Setup, Users, click the user, click their Profile, check the permission under System Permissions), with a fallback flow for orgs that manage System Permissions through permission sets. The dialog doesn’t verify the Salesforce setting; it surfaces the dependency so the admin knows to handle it before the invitee tries to connect Salesforce.
• Send the invite from the second dialog. Step two is the actual invite form: a Work Email Address input and a Role select limited to Member and Manager. Two lines of help copy explain the difference (Manager can manage team members and view all data; Member can view and work with data). Send Invite delivers the invitation, the dialog dismisses, and the new row lands in the Pending Invitations table below.
• Manage pending invitations. A second table renders directly beneath the member list when at least one invitation is outstanding, with Email, Role, and a Revoke action. Revoke pulls the pending invitation immediately so an invitee who hasn’t accepted yet can be removed from the queue.
• Read role definitions as the source of truth. Admin sees everything and can manage every teammate; admin is also the only role that can touch Plans and Billing. Manager sees all team data, can promote and demote between Manager and Member, can edit Pipeline Hygiene rules, and can drill into per-rep breakdowns. Member sees and works with their own data and the team’s pipeline at the AE level; the Manage Team page itself returns Access Denied for plain members because invite and role changes are out of scope for the role.

​

How to use it

An RevOps lead onboarding a fourth account executive opens Team & permissions on a Tuesday morning. She clicks Invite Member, reads the Before You Invite dialog, opens Salesforce Setup in a second tab, navigates to Users, clicks the new hire’s user, opens his Profile, checks “Approve Uninstalled Connected Apps,” and saves. She switches back to Katalyst, clicks I’ve enabled it — Continue, fills in his work email and picks Member as the role, hits Send Invite, and watches the new row land in the Pending Invitations table. She also picks her second account executive’s row from the member list and changes the role from Member to Manager because that AE is now covering the strategic-accounts pod, watches the page reload against the new permissions, and confirms the Pipeline Hygiene rule edit affordance now renders for her. Four minutes from page open to a wired-up team. The new hire accepts the invite that afternoon, runs his own Salesforce OAuth on Integrations, lands inside the product without an SF connection error because the permission was already in place.

​

Patterns that work

Run the Salesforce permission step before you send the invite, not after. The Before You Invite dialog flags the dependency but doesn’t verify it. The cleanest path is to actually enable the Salesforce permission on the invitee’s user while the dialog is open, then click Continue. Skipping the step and sending the invite first is the most common cause of an invitee landing on Integrations and hitting a silent OAuth failure on their first attempt to wire Salesforce. Promote to Manager when you need someone to own Pipeline Hygiene rules. The Manager role is the gate for Pipeline Hygiene rule edits and per-rep drill-ins. If a teammate is going to own the team’s hygiene baseline (Rules Tracked, the per-rep breakdown card), they need Manager. If they’re going to work their own pipeline and trust someone else’s rules, Member is the right role. Audit the team list at the start of every quarter. Role drift is real: someone who was a Manager for a deal-review push doesn’t need to stay Manager forever, an AE who left two weeks ago might still be in the member list if no one ran Remove. A five-minute quarterly pass through this page, plus a quick Revoke sweep on the Pending Invitations table for invitations older than a few weeks, keeps the team list honest. Keep the admin count small. Admin is the only role that can touch Plans and Billing and is the role that cannot be modified from this UI. Two admins is the common shape: one operations lead, one backup. Three or more usually means the org needs Manager seats, not more admins.

​

Related

• Pipeline Hygiene - the Rules Tracked card is editable by managers and admins only, so the role assignments here gate who can change the hygiene baseline.
• Integrations - the sibling Setup surface where the invitee runs their own Salesforce OAuth; the permission the Before You Invite dialog flags lives on the Salesforce side, but the OAuth handshake itself runs here.
• Opportunities - the Mine / All owner filter and the per-rep manager drill-ins depend on the role assignments on this page.
• Home - the daily landing surface; the team’s collective Do This Now feed is owner-scoped against the role assignments curated here.
• Onboard a new teammate - the end-to-end invite-through-first-day routine that opens here.
• Audit team permissions quarterly - the five-minute quarterly review that keeps the team list and pending invitations honest.