Admins, and who can see what
Everyone who can sign in to your organization is an admin. One of them is the owner, who can do a few things nobody else can.
Adding somebody sends no email and asks them nothing. You allowlist their address; they sign in the ordinary way, by asking for their own link. Tell them yourself — they have no way of knowing otherwise.
Only the owner can add an admin
Allowlisting is one-sided — nobody is asked to accept — so anyone who could add an admin could hand a colleague exactly their own standing. The set of people who can read every submission should not be able to grow without the one accountable person hearing about it.
Removing is open to any admin, because shrinking the list is the safe direction. You cannot remove yourself, and nobody can remove the owner — between them, an organization can never be left with nobody in it.
What removing somebody does
- They lose access immediately, including any session already open — the allowlist is checked on every request, not trusted from a sign-in.
- They stay in your People list. Losing administrative standing is not the same as ceasing to be somebody you ask for things.
- Requests they set up keep their name on them. That is a record of who asked, and a record that rewrites itself is not one.
Limiting somebody to their own requests
Each admin is either all — every request and every submission — or own, meaning only the ones they set up themselves. The owner is always “all” and cannot be changed, because an owner locked out by their own setting would be a state no screen could repair.
“Own” is the floor, deliberately: there is no setting that takes away somebody’s access to work they created. Your own paragraphs and photographs should not be removable by an argument.
Out-of-access reads answer exactly as if the request did not exist — the detail page, the download, the files, all of it. That is not evasiveness; a message saying “this exists but you may not see it” would disclose the thing it was refusing.
An admin is also a person
Adding an admin adds them to your People list too, so you do not type the same colleague in twice. If a coordinator has already given them a name there, it is kept — a guess made by whoever added them never overwrites the name somebody chose.
What only the owner can do
- Add an admin, and change what each one can see.
- Change the organization’s verified address, its name, logo, colour and time zone.
- Require two-factor authentication of everybody, and waive it for one person.
- Hand the organization to somebody else.