# Sharing and roles

Inviting someone onto a schedule, choosing what they can do with it, what happens on the invitee's side — who accepts or declines —, and how to leave a schedule shared with you.

## Inviting

From **Settings › Sharing** — a tab the owner and the schedule's administrators see —, the **MEMBERS** section lists who has access (the owner marked **owner**, each member with their role). Right below, **INVITE** offers a role menu — **Administrator**, **Contributor** or **Reader**, each saying in one sentence what it allows — and an **E-mail (optional)** field, then **Invite…**.

**Inviting creates an invitation, never an automatic member.** The person only becomes a member of the schedule once they **accept** the invitation; they can also **decline** it. Until then, they see nothing of the schedule, and the schedule sees nothing of them — not their name, not their absences, not their workload in the risks. This holds even for an e-mail already known to PalmaPlan.

- **With an e-mail**, the invitation is sent to that address by mail, with a link valid for **seven days** to accept or decline. If the address belongs to a confirmed PalmaPlan account, a notification is also placed in their bell, and the invitation waits for them in **All schedules**. The link is also shown on screen, to be copied and passed along by hand if the mail doesn't arrive.
- **Without an e-mail**, a link valid for seven days is created, to copy and pass on: whoever opens and accepts it joins the schedule.
- **An existing member**, invited again by their e-mail, changes role right away, with no new invitation.

A pending invitation shows up in the same list ("*e-mail* · **pending** · *role* · expires on *date*") — by the address you typed, never by a name — with a **Revoke** button that cancels it: its link stops working right away.

## What the invited person sees

**In PalmaPlan**, if they already have an account at the invited address: **All schedules** shows, above the list, an **Invitations** section — "*Who invited them* invites you as a contributor on “*schedule name*”." (or as an administrator, as a reader), **Pending**, the expiry date — with **Accept** and **Decline**. Accepting brings the schedule into **Shared with me**; declining removes the invitation, and the owner no longer sees it as pending.

**Through the link in the mail**, they land on an **Invitation** screen:

- **If they're already signed in with the right account**, **Accept** makes them join the schedule, **Decline** removes the invitation.
- **If they're signed in with a different account** than the one the invitation targets, the screen says so plainly — "This invitation is for *e-mail*; you're signed in as *other name*." — with a **Sign in with another account** link.
- **If they have no account**, the screen announces it ("*Who invited them* invites you to edit the schedule '*schedule name*'. Create your account to accept.") and offers a form — name, e-mail (already filled in if the invitation carried one), password, confirmation — whose submission **creates the account and accepts the invitation in a single gesture**: it's the only way to create a PalmaPlan account, there's no open sign-up otherwise. The person lands directly in the shared schedule, with the given role. An invitation link does not prove their address, though: a confirmation e-mail goes out at once, and until they follow it, only the schedules shared with them open — a banner reminds them. Below the form, **Decline the invitation** removes it without creating an account.

A declined or revoked invitation, opened again, says so: "This invitation has been revoked or declined."

## What the role changes

Three roles, plus the owner — a special administrator, the only one who can move the schedule to the trash, purge it or transfer it. A schedule can have **several administrators**.

| What you do | Administrator | Contributor | Reader |
|---|---|---|---|
| See the schedule, the kanban, the agenda, the history, the risks; export, print | yes | yes | yes |
| Change rows, blocks, dependencies, columns, icons, the legend | yes | yes | no |
| Create, assign, change, delete an action | yes | yes | no |
| **Check off an action assigned to you** (its status) | yes | yes | **yes, only their own** |
| Open a comment thread, resolve it | yes | yes | no |
| Reply in a thread — and edit or remove **their own** replies | yes | yes | yes |
| Their own absences | yes | yes | yes |
| The settings: work calendar, closures, information, printing, logo, "Set as default view" | yes | no | no |
| Create a version, set the reference | yes | yes | no |
| Restore a version (it replaces everything) | yes | no | no |
| Duplicate for yourself, save as a template | yes | yes | yes |
| Ask for an embedded view (`show_schedule`), which never does more than your role | yes | yes | yes, read-only |
| Invite, change a role, remove a member, revoke an invitation | yes | no | no |
| Publish, adjust the embedded view, turn on exclusive editing | yes | no | no |
| Leave the schedule | yes (not the owner) | yes | yes |
| Move to the trash, purge, transfer ownership | owner only | no | no |

A contributor opens **Settings** like everyone else, but doesn't change them: the fields are greyed out and the header says so ("Only an administrator changes these settings; you can see them without changing them.") — only the **Show the legend** box stays theirs. A reader sees **Versions** without creating or restoring any. What your role doesn't allow isn't offered on screen. The **Actions** menu offers every member **Copy an embedded view (1 h)**: the address of a view of this schedule, the one an AI displays, which never does more than your role — read-only for a reader.

A reply in a thread belongs to its author alone: nobody else — not even an administrator — edits or removes it.

**An agent** (Claude, a named token) acts with the role of the person who connected it, never more; a read-only token writes nothing, whatever that role.

**Changing a role**: the menu next to the member's name, in **MEMBERS**; the change applies at once, and that person's open screen follows it live. **Remove** (on an existing member) or **Revoke** (on a pending invitation) takes access away right away.

> **Since 0.29.0**, the former "editor" role is called **contributor**. A former editor became a contributor: they no longer adjust the schedule's settings or restore versions — the owner gives those gestures back by making them an administrator.

## Leaving a schedule

A schedule shared with you — whatever your role — can be left from **All schedules**: its row's menu, **Leave this schedule**, then **Leave** to confirm (or **Cancel**). You lose access right away — a screen still open on it loses it live — and the schedule no longer sees your absences. It's the same departure as when an administrator removes you: the rows linked to you and the actions assigned to you stay in the schedule, which flags them as belonging to a removed member. To come back, you need a new invitation.

The owner can't leave their own schedule: they first **transfer** ownership to a member (below), and can then leave it as an administrator.

## Transferring ownership

Still in **Settings › Sharing**, **OWNERSHIP › Transfer ownership…** opens a menu to pick an existing member, then **Confirm the transfer** (or **Cancel**). The text warns: "You will stay an administrator of the schedule; only the new owner will be able to move it to the trash or transfer it." — the transfer makes the chosen member the owner, and leaves you administrator on that particular schedule. Only the owner sees this section. An account can't close itself while it still owns schedules — see *[Account and data](/docs/en/account-and-data/)*.

## What happens when you get it wrong

- **An invitation sent to the wrong address**: **Revoke** it before it's accepted; the link stops working right away.
- **The wrong role was chosen**: change it in the menu next to the member's name, or re-invite the same e-mail with the other role — an existing member changes role with no new invitation needed.
- **An invitation link opened while signed in with the wrong account**: the screen says so and offers to sign in again, it never grants access to the current account.
- **An invitation you don't want**: **Decline** — in **All schedules** or on the link's screen. Nothing about you was shown to the schedule.
- **A schedule you no longer want to follow**: **Leave this schedule**, as above.

## What this page doesn't cover

- **Publishing a read-only address, with no account needed**: a different gesture — see *[Publishing](/docs/en/guides/publishing/)*.
- **Editing together on the same schedule at the same time**: see *[Exclusive editing](/docs/en/guides/exclusive-editing/)*.
- **Seeing who did what afterwards**: see *[History and Compare](/docs/en/guides/history-and-compare/)*.