# Product access (/docs/organizations/product-access)

A member's [role](/docs/organizations/roles) is the same in every product and every Space. An admin can narrow that down in three ways:

| Restriction             | Applies to             | Set on                                   |
| ----------------------- | ---------------------- | ---------------------------------------- |
| Product access          | One member             | www: the Organization's **People** tab   |
| Roles per Space         | One member             | Content: **Settings → People**           |
| Switching a product off | The whole Organization | www: the Organization's **Products** tab |

None of them deletes anything: undo one and everything is where it was.

## Keeping a member out of a product [#keeping-a-member-out-of-a-product]

On the **People** tab, an admin unticks the products a member may not use: **Improve**, **Content & Media** or **Numbers**. Their role stays the same in the products they keep.

For a product they're kept out of, they are not a member at all: the Organization doesn't show up there, its Spaces answer as if they didn't exist, and that goes for the dashboard, ⌘K, their agents and the tokens they made. Media follows Content: keep someone out of Content and they're out of Media too.

Use it for a copywriter who only needs Content, or a marketer who only needs Improve and Numbers.

## Roles per Space [#roles-per-space]

By default a member has their role in every Space of the Organization. An admin can give someone a role in **some Spaces only**, under Content's **Settings → People**. From then on they see only those Spaces, in every product, with the role they were given in each: developer, editor or reader. It can be more than their Organization role, say a client's editor who is a developer in their own Space.

Agencies use it to give a client's people their own Space and nothing else.

- **Admins are always in every Space.** To restrict an admin, make them something else first.
- A member keeps at least one Space: to take their last one away, remove them from the Organization.
- A member restricted to some Spaces who creates a Space becomes its developer.
- Transferring a Space to another Organization drops its roles per Space: there, members have their Organization role in it.

See [roles per space](https://content.obelism.studio/docs/guides/roles#roles-per-space) in Content's docs.

## Switching a product off [#switching-a-product-off]

On the **Products** tab, an admin switches **Improve** or **Content** off for the whole Organization. Its dashboard, ⌘K, the MCP tools and the agent API then refuse it (`product_disabled`) for everyone, while your sites keep working: Improve's datafile and Content's delivery still answer.

- Nothing is deleted. Switching it back on brings everything back as it was.
- An Organization keeps at least one of Improve and Content on.
- Numbers and Media have no switch: Numbers comes with either product, Media with Content.
- With Improve off, Content no longer offers the **A/B test or flag** block in its block menu. See [How the products work together](/docs/ecosystem#content-and-improve).

## What isn't restricted per member [#what-isnt-restricted-per-member]

- **Environments.** A role applies in `develop`, `staging` and `production` alike; Content's [reviewed publishing](https://content.obelism.studio/docs/guides/publishing#review-before-publishing) is how you keep production to admins.
- **Agents.** An agent can do what its person can, never more; there is no separate agent role. What you can limit is the grant: a read-only connection, or disconnecting it. See [What an agent may do](/docs/agents/permissions).
- **Two-factor authentication** can't be required for an Organization yet. Each person turns it on for their own account.

## For agents [#for-agents]

Admins' agents set product access with `updateMember` (`{ "products": ["improve"] }`, or `null` for every product) and roles per Space with `content_listSpaceMembers` and `content_setSpaceAccess`.