> For the complete documentation index, see [llms.txt](https://docs.unitlab.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.unitlab.ai/documentation/collaboration/collaboration-overview.md).

# Collaboration overview

Enterprise annotation is collaborative by design. Workspace membership establishes the identity boundary; roles and permissions control capability; project assignment and workflow stages control current responsibility; comments, Issues, Instructions, and notifications preserve context.

{% hint style="info" %}
**Use this area when:** you are onboarding a team, separating duties, operating review, or preparing a project for an internal or external workforce.
{% endhint %}

### How this area fits into production

```mermaid
flowchart TB
  A["Workspace member"]
  B["Workspace role"]
  C["Project assignment"]
  D["Workflow stage"]
  E["Task ownership"]
  F["Comment, Issue, or review decision"]
  A --> B
  B --> C
  C --> D
  D --> E
  E --> F
```

![Roles and permissions settings](https://292810646-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGjVLUz4wthGkGlRKM6rM%2Fuploads%2Fae9ur8IvUdY0Oj98kTAD%2Froles-permissions.png?alt=media\&token=605e99b1-c6d9-4642-8d2f-b724c50790ab)

*The permission matrix should be read alongside project assignment and workflow-stage eligibility; one layer alone does not describe effective access.*

### What this area controls

### Authentication and account recovery

Unitlab supports email/password sign-up and sign-in, Google authentication, email verification, invitation-token access, password reset, and TOTP two-factor authentication.

Two-factor authentication includes QR/secret setup, verification, ten single-use backup codes shown once, login challenge, disable, and backup-code regeneration. When 2FA is enabled, password change, password-reset completion, account deletion, and workspace destruction require an appropriate second factor.

If a user refreshes during the temporary 2FA login challenge, the challenge is cleared and the user returns to login rather than leaving reusable sensitive state in the browser.

### First-workspace onboarding

1. The user authenticates.
2. If no workspace exists, Unitlab opens the workspace wizard.
3. The user selects a purpose: Work, Education, or Personal.
4. The user enters a workspace name.
5. The user can optionally invite teammates.
6. Unitlab creates the workspace, makes the user Owner, provisions the free subscription, and creates the initial workspace API key.
7. The application switches into the new workspace and guides the user toward projects.

Guided quick-start actions include creating a project, creating or cloning a release, inviting members, integrating a model, configuring reviewer or custom-model projects, trying batch/crop auto-annotation or Magic Touch, and opening project/member statistics.

### Workspace switching and settings

The workspace area includes:

* workspace list and switcher;
* general settings for name, purpose, and logo;
* account security and 2FA;
* billing and pricing portal;
* usage and quota visibility;
* members and member statistics;
* Roles & Permissions editor;
* API keys;
* cloud storage connections;
* user profile.

Usage can report datasource, image, video, medical, token, audio-duration, AI-inference, and member consumption. The interface warns when a downgraded plan would be exceeded.

Workspace destruction is intentionally different from leaving a workspace. It is Owner-only, requires the exact workspace name, and requires a second factor when the Owner has 2FA.

### Members

Member management supports search, filtering, invitations, role changes, member actions, analytics, and Active, Pending, Disabled, and Rejected states. Pending invitations can be resent.

### Start with the right page

| Decision            | Production guidance                                    |
| ------------------- | ------------------------------------------------------ |
| Bring in a person   | Invite and manage members.                             |
| Define capability   | Use role-based access and permission groups.           |
| Assign current work | Use project membership, workflow stages, and queues.   |
| Preserve context    | Use Instructions, comments, Issues, and notifications. |
| Remove access       | Follow the offboarding runbook.                        |

### Operating boundary

* Workspace role, project role, workflow-stage action, and current assignment are distinct layers.
* Comments preserve context; Issues create owned follow-through; workflow review changes task state.
* External workforces should receive the minimum project and data access required.

### A production-ready handoff

Every person and service identity has a named sponsor, minimum role, intended projects, current responsibilities, review date, and offboarding path.