Members & roles

A member is a membership linking a Shopware customer to a company. Each membership carries a role and a status.

Roles and their rights

There are exactly three built-in roles:

Role	Label	May …
owner	Owner	Invite members, change roles (including granting the owner role), remove members, manage company addresses.
admin	Administrator	Invite members, change roles (but not grant or change the owner role), remove members (but not remove owners), manage company addresses.
member	Member	Act for the company (order, use company addresses in checkout). No management rights.

In short: Owner and Administrator are the managing roles. Everything that changes members or addresses is restricted to them.

Authorisation is enforced server-side

Rights are not only hidden in the UI, they are checked server-side on every action. What always counts is an active membership — a merely invited (pending) member cannot trigger any management action.

Status

Status	Label	Meaning
active	Active	A full membership. Counts toward the active company and management rights.
invited	Invited	An open invitation to an existing customer. Not an effective membership until the invitation is accepted.

Managing members (storefront)

All the following steps happen in the customer account. The management controls are only visible and executable for Owners and Administrators.

Getting to the members page

1. Sign in as a member of a company.
2. In the account sidebar, under the Company account group, click Members.
3. The member list appears with name, email, role and status.

Inviting a member

On the members page, the Invite a member section is available (for owners/admins). The full flow is described under Invitations.

Changing a member's role

1. In the member list, choose Change role for the member.
2. Set the new role.
3. The shop confirms with "The member's role has been updated."

Removing a member

1. In the member list, choose Remove for the member.
2. The shop confirms with "The member has been removed."

Protection rules (invariants)

So that a company is never left leaderless or restructured without authority, the following fixed rules apply regardless of the UI:

Last-owner protection

The last remaining owner can be neither demoted nor removed. As long as only one active owner exists, any attempt to demote or delete them fails.

Only owners grant the owner role

Only an owner may grant, change or revoke the owner role. So an administrator can not promote themselves to owner and can not remove or demote an owner.

Further safeguards:

• An action is only possible when an active company is selected. Otherwise "No active company is selected." appears.
• The target member must actually belong to the active company. A foreign identifier slipped into the request is rejected (protection against unauthorised access to other companies' data).
• If an action fails, a generic message appears ("The action could not be completed."); the technical details only go to the log.

Multiple memberships

A customer can be a member of several companies — with a separate role per company. Which company is currently authoritative is controlled by the company switcher.