# Sharing and access

> Team roles, who can run each function, and who sees which runs.

Source: https://callables.app/docs/sharing

Callables decides who can run each function, and keeps each person's runs private by default.

## Roles

Everyone on a team has one role:

| Role | Can |
|---|---|
| Owner | Everything, including deleting the team and managing other owners |
| Admin | Manage the team and its people, but not delete it or change owners |
| Builder | Connect repos, deploy, and manage the functions they deploy |
| Member | Run the functions shared with them |

Most people in a company are members: the people in support, ops or finance who run tools but don't write them.

## Sharing a function

A newly deployed function is private. Only the builder who deployed it, and owners and admins, can run it. In the function's sharing settings, either:

- **Share it with the whole team**, for tools anyone can use, or
- **Add people** with **Can run** (see and run it) or **Can manage** (also change its sharing, and see all its runs and schedules).

Builders don't automatically see each other's functions, so a payroll tool isn't visible to every engineer who can deploy.

## Who sees which runs

- Everyone sees their own runs.
- People who manage a function see all of its runs.
- Owners and admins see every run on the team.

## Flows and secrets

- In a [flow](https://callables.app/docs/flows), people only see next actions they're allowed to run.
- People who run a function never see its [secrets](https://callables.app/docs/secrets).
- Tracebacks are shown to builders only. People running a function see the error message.

## Inviting people

Invite people by email or with an invite link, and pick their role when you invite them. On Pro, you can add a trusted email domain, so anyone with a company email address can join.