Access in Atwork has two levels. The workspace has one Owner, who runs Administration. Each space and sheet has its own list of who can open it, and a role for each of them: Owner, Admin, Editor, Operator, Viewer or Filler. The role decides what that person can do there.
The person who created the workspace is its Owner. Only the Owner sees Administration in the profile menu, with Organization, Users, Teams, Jobs, Locations, the Customer Portal pages and Billing.
Everyone else in Users is a member. There is no workspace-wide role to pick for a member: what they can open and change is set space by space and sheet by sheet.
| Role | What they can do | Typical use |
|---|---|---|
| Owner | Everything, always. The space's owner is the person who created it, and they also own every sheet in it. | Whoever set the space up |
| Admin | Everything an Editor can, plus manage who has access, publish views, and delete views and sheets. | The lead of a space or an account |
| Editor | Shape the work: add and change fields and views, create sheets, and create, edit and delete items. | People who design the workflow |
| Operator | Create, edit and delete items. Cannot change fields or views. | People who do the work day to day |
| Viewer | Open and read. Cannot change items, fields or views. | Stakeholders who need to follow along |
| Filler | Used by published forms, so submissions can come in. You don't normally give it to a person. | Published forms |
Only the space's Owner and its Admins can change access.
For a space:

You can also use the Participants card on the space's home page. Its + button (Add participant) opens the same dialog. Click a person on the card to change their role or choose Remove access.
For a sheet: open the sheet, click Config, then Access. The participant avatars at the top of a sheet also have a Manage access link for Admins.
A new sheet follows its space. Its Config → Access page says "Inherited from the … space": everyone who can reach the space reaches the sheet with the same role.

As soon as you add anyone on that page, or change someone's role there, the sheet gets its own list and shows "This sheet has its own permissions". From then on, changes to the space's access no longer reach it.
Removing a line on its own does not do this. The sheet keeps following its space, so anyone you later add to the space reaches the sheet too.
To make a sheet private to a few people, first add those people on the sheet's Access page, so the sheet gets its own list. Then remove the Organization line and any team lines.
The strongest grant wins. Personal, team and Organization grants are combined, and the person gets the highest role among them.
So you cannot give one person less than their team or the whole Organization already has. To restrict someone, add the people who should keep access one by one, then remove the broader grant.
Not through roles. Guests open what you publish with Guest access, and portal users sign in to your portal to see their own records. Neither takes a seat. See Members, guests and portal users and Share a view.
Work down the list. The first check that fails is the answer.
See Why can't my teammate see a sheet?
An Editor can change how a sheet works: its fields, its views, and which sheets exist in the space. An Operator works with the items inside it, creating, editing and deleting them, but cannot change fields or views.
Yes. Admins can delete views and sheets. Editors cannot.
They probably reach it through their team or through the whole Organization. Check the Access list for a team line or an Organization line.
No. Guests come from publishing: turn on Guest access when you publish a view or a page.
Not from the access list. When you delete a member in Users, Atwork asks for a replacement person, and everything the member created, including the spaces and sheets they own, is assigned to that person.
Related: Teams and jobs · Members, guests and portal users · Spaces, folders and sheets · Why can't my teammate see a sheet? · Pricing