--- title: "Control who reads what" description: "A role says what someone may do. A grant says which addresses they may do it to." url: "https://openemail.uk/features/team-security" --- Trust and safety # Control who reads what roles and grants A role says what someone may do. A grant says which addresses they may do it to. [Open mail](https://openemail.uk/mail/inbox) [Get Started](https://openemail.uk/signup.md)[Every walkthrough](https://openemail.uk/features/in-practice.md) Roles and grants MK Mara Kell Two-factor on Member Mail Organising Domains Keys support @acme.com Can send hello @acme.com Can send billing @acme.com No access The role sets what. The grant sets which address. How it works ## Running in three steps. 1. 01 Invite by address The invitation carries the role and the addresses. Nothing is granted until acceptance. 2. 02 Pick the role Six roles ship. Write your own by ticking the permissions it should hold. 3. 03 Require two-factor Switch it on and anyone without it meets a lockout instead of the mail. What it runs on ## The parts doing the work. Nothing here is a separate product. Each one is a piece of the mailbox you already have. Roles & permissions levels A role says what somebody may do; an address grant says what they may do it to. Sarah support@ Alex billing@ Nina careers@ read, or read and send as it, with nothing else visible Scoped visibility One address means one address. Sarah support@ Alex billing@ Nina careers@ read, or read and send as it, with nothing else visible Share an address Hand billing@ to the person who does the billing. share with sarah@acme.com SA AL NI have access Invitations Share with someone who has not signed up yet and have them invited. billing@acme.com shared SSarah AAli JJamie NNadia No seat added. The bill does not move. Account security A code from your authenticator app, on top of your password. Nearby ## Other jobs for the same inbox. Hand a mailbox over An address belongs to the workspace, so the person changes and the mail stays put. ops@northroad.com 09:14 kai@paleleaf.io 08:02 hello@ acme.com DI RK read send Give every team an address Make any address on your domain and hand it to the people who answer it. hello@ acme.com SR read and send press@ acme.com AK read \*@acme.com catch-all Run mail for clients Keep every client in its own workspace, with its own domains, people and rules. NR HV PL BC northroad.com hello@ @northroad.com billing@ @northroad.com AB KM 6 filters [Every walkthrough](https://openemail.uk/features/in-practice.md)