The Implementation Admin role
The Implementation Admin role
Implementation Admin is a time-limited assistant role for upcoach staff or implementation partners. It exists so an outside expert can help you set up, fix a thing, or migrate content without joining your team permanently and without using a seat.
What it can do
An Implementation Admin has the same access as a regular Admin, with two limits:
- Cannot assign the Owner role to anyone
- Cannot be made Owner themselves
Everything else an Admin does — Users, Spaces, Reports, integrations, MCP connections, brand settings — is in scope. They can manage your programs and your team while their assignment is active.
How it’s different from Admin
| Behavior | Admin | Implementation Admin |
|---|---|---|
| Manages Users, Spaces, Reports | Yes | Yes |
| Manages billing and Stripe | No | No |
| Assigns the Owner role | No | No |
| Can be made Owner | Yes | No |
| Uses a seat | Yes | No |
| Time-limited (auto-expires) | No | Yes |
| Domain-restricted at invite | No | Yes |
Before you can invite one
Implementation Admin is off by default. Turn it on first:
- Open Admin Area > Brand & Settings (or Organization Settings)
- Find the Allow Implementation Admin role toggle
- Turn it on
You can turn it off again at any time. Turning it off removes every active Implementation Admin from your organization immediately, sends them an email, and revokes any MCP or API tokens they hold. A confirmation modal warns you before this happens.
Invite an Implementation Admin
- Open Admin Area > Users
- Click Invite Users
- Paste their email address
- Choose Implementation Admin as the role
- Pick a Duration:
- 1 month, 2 months, 3 months, 6 months, or Forever
- Customize the message if you want
- Click Send Invitations
If the email doesn’t match an allowed domain, upcoach rejects the invite with a message that lists the domains your account can use. Your upcoach account team manages this allowlist — common defaults are upcoach.com and partner domains.
The whole batch is rejected if even one email in it doesn’t match the allowlist.
What happens when it expires
When the duration runs out (or you trigger removal early), upcoach:
- Removes the Implementation Admin assignment from the user
- Revokes any MCP, API, or OAuth tokens they hold (so any automations they set up stop working immediately)
- Sends an email to both the user and whoever originally invited them — naming the organization and suggesting a re-invite if access is still needed
- Writes an audit log entry
The user still has an upcoach account — they just no longer have access to your organization unless someone re-invites them.
Forever assignments
You can pick Forever as the duration if a partner needs long-running access. There’s no automatic expiry on these. To remove them, either:
- Remove the user individually from Admin Area > Users
- Or turn off Allow Implementation Admin role in organization settings, which clears every active Implementation Admin at once
Your account team reviews forever assignments periodically as a routine.
Remove an Implementation Admin early
You don’t have to wait for an Implementation Admin’s duration to run out:
- Open Admin Area > Users
- Find the user (they’ll show with the Implementation Admin role badge)
- Open the row’s three-dot menu
- Select Remove Implementation Admin role
- Confirm
The user is removed immediately. Tokens are revoked. The same expiration email is sent.
Seat impact
Implementation Admins do not use a seat. You can invite them at any time without checking your seat usage, and removing one doesn’t free a seat. See Seats and billing for team roles for the full counting rule.
Audit trail
Every Implementation Admin action — invite, removal, expiry — writes an entry to your organization’s role audit log. The original inviter is recorded as the actor, even when removal happens automatically through expiry.