Docs / Team and floor

Teams and roles

Invite people, give each one of four roles, set two dollar limits per role, and keep one rule: nobody approves their own work except the owner.

In the demo

Built. The Team screen is owner only. Lockstock sends no invite email: you copy a ready-made message and send it yourself.

The five roles

Role	Does directly	Sees costs
Owner	Everything. The only role that can manage the team, set limits, use all-stop, connect QuickBooks or Shopify, change the costing method, commit a switch-in, make Connect AI tokens, export and delete the account.	Yes
Purchaser	Vendors, purchase orders, receiving, vendor returns, quotes, price lists, sales orders, reorder rules, units, locations, transfers and customer returns.	Yes
Production	Work orders, the shop floor kiosk, counts and stock moves.	No
Warehouse	Receiving, pick, pack and ship, counts, moves, transfers, customer returns and locations.	No
Viewer	Reads only. Cannot do or propose anything.	Yes

Production and warehouse never see unit costs, stock value or vendor prices, on screens, in the assistant, or through MCP and REST. A direct request for a cost field from those roles is refused. The sidebar lists only what a role can open.

The Team screen also holds a plain role guide with four lines for each role: what it sees, does, proposes and approves.

Invite someone

Sign in as the owner and open Team in the sidebar.
Type their email address, pick Purchaser, Production, Warehouse or Viewer, and press Invite. A workspace has one owner, so Owner is not offered.
A message appears with the sign-in link. Press Copy message and send it to them yourself. Lockstock sends no invite email.
They sign in at that link with the same address, using Google, GitHub or the emailed code. If the code email lands in Spam, they mark it as not spam. Their row turns from Invited to Active, with the time of their last sign-in.

A badly typed address, an address already in the workspace and a full workspace are refused with the reason, and nothing is added. What you typed stays.
A repeat press on the same invite is the same invite, not a second one.
A person who joins by invite joins your workspace only.
Cancel invite, on a pending row, withdraws it before they sign in.

Change a role or remove someone

Pick a new role in the list. It applies on that person's very next request, and the sidebar they see changes with it. If the save fails, the old role still shows.
Remove asks you to confirm. After that, that person's next request sends them to sign in, and the address is refused. Their past entries in the activity log stay, marked Former member.
The owner row has no controls. The owner cannot be changed or removed.
Only the owner sees this screen. Anyone else who opens it reads Only the owner manages the team.

Limits and proposals

Purchaser, production and warehouse each carry two dollar limits: spend (purchase orders and vendor returns) and write-off (adjustments, scrap and count variances). Both start at $0. The owner sets them on Team, under Role limits, one role at a time, as zero or more dollars.

An action within your limit applies at once.
An action above it becomes a proposal in Approvals. The proposer sees Waiting for someone else on their own proposals.
A role that does not do that kind of action is refused.
Only the owner approves their own proposals.

Role	Can approve (within its limit)
Purchaser	Purchase orders, vendor returns, reorder rule changes
Production	Work order completions and complete-anyway, scrap, adjustments, count variances
Warehouse	Count variances, return dispositions, return write-offs
Owner	Anything

Approvals has its own Limits tab for the owner. It shows each role's limits as a read-only table with a link back to Team, and holds the auto-apply limit and approved vendors for agents, and all-stop. A member who opens that tab is told the owner sets it, and that their own limit is set on Team.

Members

A workspace has one owner and up to 25 members. Pending invites count toward the 25.
Sign-in is invite-only. An address that is not on the list gets Lockstock is invite-only. Ask Adithya for a seat.
One person can belong to several workspaces. Each membership has its own role.
The activity log names who did what, with their role.

Not on the list at all? Ask for a pilot seat on the support form.