Connect operational profiles to individual login accounts, assign least-privilege roles, and protect seat and Owner safeguards.
Use a training account or non-production workspace. Use only example.test identities. Never test by changing a live employee or the final active Owner.
Welcome to PITCH Owner 04. Account access is an accountability chain: prepare the person's operational profile, create one individual login, assign the right role, and verify what the account can reach. This lesson shows how to add seats without sharing credentials, over-permissioning a teammate, or weakening the Owner safeguards that keep the workspace recoverable.
PITCH keeps an operational Workforce Profile connected to, but distinct from, a login account. The profile holds the person's worker type, qualifications, crew, and employment context. Access and Seats controls whether that person can sign in, which role they receive, and whether the account is active. Prepare the profile first when possible, then create or connect the login so assignments and access stay tied to the same person.
Before adding an account, review the current plan, active accounts, and remaining capacity. Each active login uses a seat. Give every person a unique email and a unique temporary passphrase of at least twelve characters. Never recycle a shared team login. Select the role that matches the work they actually perform. If capacity is full, the add button is blocked and PITCH directs you to the required plan change before another account becomes active.
Use the smallest role that completes the person's real responsibilities. Owner carries full workspace, financial, billing, security, and team control. Administrator provides broad operational administration without ownership identity. Manager oversees sales and production. Sales, Production, and Accounting receive focused workspaces for their functions. Only an Owner can grant or change Owner access. Review the role guide before saving, then verify the new account's dashboard and navigation in the training workspace.
Access changes have immediate safeguards. You cannot disable your own account or change your own role from this page. PITCH preserves at least one active Owner, so the final Owner cannot be disabled or demoted. Changing a role invalidates existing sessions, and disabling an account rejects its sessions immediately. Reactivation consumes an available seat; if the plan is full, PITCH requires capacity first. Compensation remains restricted unless the sensitive compensation permission is explicitly granted.
Now complete the guided practice in a non-production workspace. Prepare one training-only workforce profile. Check seat capacity. Create a unique practice login, assign the least-privilege role, and keep the temporary password private. Sign in only with the authorized training account and confirm the dashboard, navigation, and linked profile. Then test a role change or disable and reactivate cycle without touching the final Owner. The setup is ready when one person has one verified account, the correct access, and an intact ownership path.