Under Admin → Users you invite people and set what they can see.
- Invite with a work email; they receive a sign-in link.
- Assign a role: Viewer (read published reports), Operations (operational reports and reconciliations), Finance (financial reports and statements), or Admin (everything, plus settings and user management).
- Changing a role takes effect on their next sign-in at the latest.
Guidelines that keep this clean:
- Give the lowest role that does the job. It's a finance product — least access is the professional default, and you can always raise it later.
- Individual reports can additionally be limited by role when published, so a sensitive report can be Finance-and-Admin-only even though the person can see the rest.
- When someone leaves, remove them here — their access ends immediately.