Assessment work rarely belongs to one person from start to finish. A lead auditor defines scope, specialists log findings, developers answer questions, managers track remediation, and a client may need a read-only view before the final report. Collaboration helps, but only when everyone can reach the work they need without receiving control over the entire workspace.
The cost of treating every collaborator the same
A shared password or unrestricted spreadsheet link makes onboarding easy for a few minutes and creates long-term uncertainty. Nobody can tell who changed a finding, former contractors may retain access, and a client who only needed to read results can accidentally edit them. At the other extreme, an overly restrictive setup forces the lead auditor to copy updates between systems and turns routine collaboration into a queue.
A useful permission model separates ownership, administration, project work, assignment, and external review. These are different responsibilities. The person who pays for and owns a workspace should not have to make every finding edit. A specialist assigned to one project should not manage billing. A client reviewing remediation should not become a permanent team member unless the engagement genuinely requires it.
Start with the three workspace roles
voiqq uses one protected Team leader, optional Team admins, and Workspace members. The Team leader is the ownership boundary. That person controls member roles, protected project deletion, plan management, and any future ownership transfer. Team admins handle project and team operations without gaining the ability to remove the leader. Workspace members do project work available through membership or assignment.
For a solo professional, the auditor begins as Team leader and can invite a client later. In an agency, a practice lead may remain Team leader while engagement managers become Team admins and auditors become Workspace members. In a school, the course owner can lead the workspace while students work in selected projects. An internal company team can reserve Team admin for people who genuinely manage several assessments.
Invite people with a deliberate role
Open Team, find Invite people, enter the colleague's email address, choose Team admin or Workspace member under Workspace role, and select Send Invites. The recipient accepts with the same email address. This creates an accountable membership instead of an anonymous shared credential. Pending invitations remain visible so the Team leader can revoke an incorrect address before it becomes active.
- Use Team admin for people who manage projects or membership, not as a courtesy title.
- Use Workspace member for auditors, reviewers, developers, and students who need project work without workspace control.
- Check the email address and role before selecting Send Invites.
- Remove expired or unnecessary pending invitations.
- Review active membership when an engagement, contract, course, or employment relationship ends.
Narrow work through projects and assignments
A workspace role is only the first boundary. Project access and finding assignment help direct the actual work. Give a Workspace member the project membership needed for the engagement, then assign findings where responsibility matters. Briefings, activity, comments, evidence, status, and validation can now follow an identifiable person without exposing unrelated projects.
This distinction matters when one agency runs Accessibility, SOC 2, web application security, mobile security, and AI security reviews for different clients. A tester assigned to a MASVS project does not need access to an unrelated procurement Accessibility project. A remediation owner can respond to assigned findings without becoming a workspace administrator. Permission remains connected to the work.
Choose membership or a project share link for clients
Use membership when the client will collaborate repeatedly, receive assignments, participate in the private workspace workflow, or need accountable access across several projects. Use a project share link when the client needs temporary access to one project. Open Share, choose Anyone with link, and select View only, Commenter, or Editor according to the task.
View only is suitable for a stakeholder reviewing current findings. Commenter supports discussion without finding edits. Editor supports limited finding updates through the public project path but does not permit project or finding creation and deletion, team administration, billing, or the private activity widget. Turnstile and a signed short-lived grant protect the route, while the project token and current share setting remain the source of permission.
Control the public portfolio through existing project sharing
A published professional portfolio lists only projects already set to Anyone with link. Each card opens the project's normal share route and keeps its View only, Commenter, or Editor setting. Returning a project to Private removes it from the portfolio. This gives the professional one permission control instead of a second portfolio-specific access engine.
Handle role changes and departures safely
Change a role when responsibility changes, not merely because someone asks for broader access. Remove a member when collaboration ends. The protected removal flow clears dependent project membership and assignments without deleting work that belongs to the retained workspace. The Team leader cannot be removed through the ordinary member action.
If the Team leader must leave, transfer ownership first. This is especially important before account deletion. A shared workspace contains projects, findings, evidence, reports, comments, history, invitations, and client responsibilities that may belong to several people. voiqq blocks unsafe deletion rather than leaving that workspace without an accountable owner.
Run a simple access review
- Confirm the active Team leader is the current accountable owner.
- List Team admins and record why each person needs that role.
- Review Workspace members against active projects and assignments.
- Check pending invitations for wrong addresses, outdated roles, and expiry.
- Open each public project Share panel and verify Private or Anyone with link is intentional.
- Test View only, Commenter, and Editor links in a signed-out browser when external access matters.
- Remove access that no longer supports a current engagement.
- Repeat the review after major staffing, client, ownership, or subscription changes.
Permissions should make professional work easier to trust
Students gain a clear model for accountable group work. Independent professionals can invite a client without exposing every project. Agencies can separate engagement teams while keeping leadership control. Schools, government bodies, and companies can show who owns the workspace, who administers it, who performs the assessment, and who only reviews the result. The practical benefit is less copying, fewer ambiguous changes, and a cleaner path from finding to remediation and report.