diff --git a/components/ProjectGroupPicker.vue b/components/ProjectGroupPicker.vue
index 86826de..b856bf4 100644
--- a/components/ProjectGroupPicker.vue
+++ b/components/ProjectGroupPicker.vue
@@ -4,22 +4,50 @@
     class="project-group-picker form-select"
     aria-label="Project Group Selection"
   >
-    <option v-for="pg in projectGroups" :key="pg.id" :value="pg.id">
+    <option
+      v-for="pg in projectGroups"
+      :key="pg.tdei_project_group_id"
+      :value="pg.tdei_project_group_id"
+    >
       {{ pg.name }}
     </option>
   </select>
 </template>
 
 <script setup lang="ts">
-import { tdeiUserClient } from '~/services/index'
+import { tdeiUserClient } from '~/services/index';
+import type { TdeiProjectGroupItem } from '~/types/tdei';
+import { compareStringAsc } from '~/util/compare';
 
-const model = defineModel({ required: true });
-const projectGroups = (await tdeiUserClient.getMyProjectGroups())
-  .sort((a, b) => a.name.localeCompare(b.name));
+const model = defineModel<string | undefined>({ required: true });
+const props = defineProps<{ options?: TdeiProjectGroupItem[] }>();
 
-if (projectGroups.length > 0) {
-  if (!model.value || !projectGroups.some(pg => pg.id === model.value)) {
-    model.value = projectGroups[0].id;
+const fetchedGroups = ref<TdeiProjectGroupItem[]>([]);
+
+if (!props.options) {
+  try {
+    fetchedGroups.value = (await tdeiUserClient.getMyProjectGroups()).sort(
+      compareStringAsc(g => g.name),
+    );
+  }
+  catch {
+    fetchedGroups.value = [];
   }
 }
+
+const projectGroups = computed(() => props.options ?? fetchedGroups.value);
+
+watch(
+  projectGroups,
+  (groups) => {
+    if (groups.length > 0) {
+      const pgId = model.value;
+
+      if (!pgId || !groups.some(pg => pg.tdei_project_group_id === pgId)) {
+        model.value = groups[0]?.tdei_project_group_id;
+      }
+    }
+  },
+  { immediate: true },
+);
 </script>
diff --git a/components/dashboard/DetailsTable.vue b/components/dashboard/DetailsTable.vue
index 5d37613..f213702 100644
--- a/components/dashboard/DetailsTable.vue
+++ b/components/dashboard/DetailsTable.vue
@@ -1,6 +1,6 @@
 <template>
-  <div class="table-responsive border-top">
-    <table class="table table-striped mb-0">
+  <div class="table-responsive border-top mb-0">
+    <table class="table table-striped">
       <tbody>
         <tr>
           <th><app-icon variant="schedule" />Created At</th>
@@ -10,6 +10,41 @@
           <th><app-icon variant="person_outline" />Created By</th>
           <td>{{ workspace.createdByName }}</td>
         </tr>
+        <tr>
+          <th><app-icon variant="badge" />My Role</th>
+          <td>
+            <span
+              v-if="workspace.role === 'lead'"
+              class="badge bg-dark text-uppercase"
+            >
+              <app-icon variant="star" /> Owner
+            </span>
+            <span
+              v-else-if="workspace.role === 'validator'"
+              class="badge bg-dark text-uppercase"
+            >
+              <app-icon variant="task_alt" /> Validator
+            </span>
+            <span
+              v-else
+              class="badge bg-secondary text-uppercase"
+            >
+              <app-icon variant="person" /> Member
+            </span>
+            <span
+              v-if="isPoc"
+              class="badge bg-warning text-dark text-uppercase ms-1"
+            >
+              <app-icon variant="local_police" /> POC
+            </span>
+            <span
+              v-else-if="isDataGenerator"
+              class="badge bg-warning text-dark text-uppercase ms-1"
+            >
+              <app-icon variant="offline_bolt" /> Data Generator
+            </span>
+          </td>
+        </tr>
         <tr>
           <th><app-icon variant="phonelink_setup" />App Access</th>
           <td>
@@ -42,12 +77,19 @@
 </template>
 
 <script setup lang="ts">
-const props = defineProps({
-  workspace: {
-    type: Object,
-    required: true
-  }
-});
+import type { Workspace } from '~/types/workspaces';
+
+interface Props {
+  workspace: Workspace;
+  myTdeiRoles: string[];
+}
+
+const props = defineProps<Props>();
+
+const isPoc = computed(() => props.myTdeiRoles.includes('poc'));
+const isDataGenerator = computed(() =>
+  props.myTdeiRoles.includes(`${props.workspace.type}_data_generator`),
+);
 </script>
 
 <style lang="scss">
diff --git a/components/dashboard/Toolbar.vue b/components/dashboard/Toolbar.vue
index 76f788b..e829b0d 100644
--- a/components/dashboard/Toolbar.vue
+++ b/components/dashboard/Toolbar.vue
@@ -32,8 +32,8 @@
         <app-icon variant="settings" size="24" no-margin />
         <span class="d-none d-sm-inline ms-2">Settings</span>
       </nuxt-link>
-    </div>
-  </div>
+    </div><!-- .btn-group -->
+  </div><!-- .btn-toolbar -->
 </template>
 
 <script setup lang="ts">
diff --git a/components/dashboard/WorkspaceItem.vue b/components/dashboard/WorkspaceItem.vue
index 3a2787d..b6a9b95 100644
--- a/components/dashboard/WorkspaceItem.vue
+++ b/components/dashboard/WorkspaceItem.vue
@@ -9,10 +9,25 @@
       <app-icon v-else variant="lock" />
       App
     </span>
+
+    <span
+      v-if="workspace.role === 'lead'"
+      class="badge bg-dark ms-2"
+    >
+      <app-icon variant="star" /> {{ ROLE_LABELS.lead }}
+    </span>
+    <span
+      v-else-if="workspace.role === 'validator'"
+      class="badge bg-dark ms-2"
+    >
+      <app-icon variant="task_alt" /> {{ ROLE_LABELS.validator }}
+    </span>
   </button>
 </template>
 
 <script setup lang="ts">
+import { ROLE_LABELS } from '~/util/roles';
+
 const props = defineProps({
   workspace: {
     type: Object,
diff --git a/components/review/Toolbar.vue b/components/review/Toolbar.vue
index 98edf75..033505a 100644
--- a/components/review/Toolbar.vue
+++ b/components/review/Toolbar.vue
@@ -45,16 +45,27 @@
         {{ props.item.commentCount }}
       </span>
     </button>
-    <button
-      v-show="props.item.isFeedback"
-      class="btn btn-sm btn-success ms-2"
+    <BPopover
+      content="Only validators and owners can resolve feedback"
+      placement="bottom"
+      :manual="isValidator"
     >
-      <app-icon
-        variant="check"
-        no-margin
-      />
-      <span class="d-none d-sm-inline ms-2">Mark as Resolved</span>
-    </button>
+      <template #target>
+        <div class="d-inline-block ms-2">
+          <button
+            v-show="props.item.isFeedback && !props.item.isResolved"
+            class="btn btn-sm btn-success"
+            :disabled="!isValidator"
+          >
+            <app-icon
+              variant="check"
+              no-margin
+            />
+            <span class="d-none d-sm-inline ms-2">Mark as Resolved</span>
+          </button>
+        </div>
+      </template>
+    </BPopover>
   </nav>
 </template>
 
@@ -66,6 +77,7 @@ interface Props {
 }
 
 const props = defineProps<Props>();
+const { isValidator } = useWorkspaceRole();
 
 const emit = defineEmits(['edit']);
 const showDetails = defineModel<boolean>('showDetails');
diff --git a/components/settings/Nav.vue b/components/settings/Nav.vue
index 06482be..f5d84f7 100644
--- a/components/settings/Nav.vue
+++ b/components/settings/Nav.vue
@@ -6,9 +6,15 @@
     >
       General
     </settings-nav-link>
+    <settings-nav-link
+      to="/members"
+      icon="admin_panel_settings"
+    >
+      Members
+    </settings-nav-link>
     <settings-nav-link
       to="/teams"
-      icon="group"
+      icon="diversity_3"
     >
       Teams
     </settings-nav-link>
diff --git a/components/settings/panel/Apps.vue b/components/settings/panel/Apps.vue
index a142729..9557a18 100644
--- a/components/settings/panel/Apps.vue
+++ b/components/settings/panel/Apps.vue
@@ -8,6 +8,16 @@
         External Apps
       </h3>
 
+      <b-alert
+        v-if="!isLead"
+        variant="info"
+        show
+        class="mb-3"
+      >
+        <app-icon variant="info" />
+        Only workspace owners can change external app settings.
+      </b-alert>
+
       <div class="form-check form-switch">
         <label class="form-check-label">
           <input
@@ -16,6 +26,7 @@
             class="form-check-input"
             :true-value="1"
             :false-value="0"
+            :disabled="!isLead"
           >
           Publish this workspace for external apps
         </label>
@@ -36,6 +47,7 @@
             type="radio"
             name="longFormQuestType"
             value="JSON"
+            :disabled="!isLead"
           >
         </label>
       </div>
@@ -48,6 +60,7 @@
             type="radio"
             name="longFormQuestType"
             value="URL"
+            :disabled="!isLead"
           >
         </label>
       </div>
@@ -61,6 +74,7 @@
             :class="{ 'drag-over': isDraggingQuest }"
             rows="5"
             placeholder="Optional"
+            :disabled="!isLead"
             @dragover.prevent="isDraggingQuest = true"
             @dragleave.prevent="isDraggingQuest = false"
             @drop.prevent="onQuestFileDrop"
@@ -96,6 +110,7 @@
             type="text"
             class="form-control"
             placeholder="https://..."
+            :disabled="!isLead"
           >
         </label>
         <div
@@ -131,6 +146,7 @@
       <button
         type="submit"
         class="btn btn-primary"
+        :disabled="!isLead"
       >
         Save
       </button>
@@ -157,6 +173,7 @@ const longFormQuestSchemaUrl = import.meta.env.VITE_LONG_FORM_QUEST_SCHEMA;
 const longFormQuestExampleUrl = import.meta.env.VITE_LONG_FORM_QUEST_EXAMPLE_URL;
 
 const workspace = inject<Workspace>('workspace')!;
+const { isLead } = useWorkspaceRole();
 
 const [longFormQuestSettings] = await Promise.all([
   workspacesClient.getLongFormQuestSettings(workspace.id),
diff --git a/components/settings/panel/Delete.vue b/components/settings/panel/Delete.vue
index fb2c4bd..189a87d 100644
--- a/components/settings/panel/Delete.vue
+++ b/components/settings/panel/Delete.vue
@@ -5,6 +5,16 @@
         Delete Workspace
       </h3>
 
+      <b-alert
+        v-if="!isLead"
+        variant="info"
+        show
+        class="mb-3"
+      >
+        <app-icon variant="info" />
+        Only workspace owners can delete the workspace.
+      </b-alert>
+
       <p>
         Deleting a workspace is permanent. This action will not remove any
         TDEI datasets outside of Workspaces.
@@ -12,7 +22,7 @@
 
       <button
         class="btn btn-outline-danger mb-3"
-        :disabled="accepted"
+        :disabled="!isLead || accepted"
         @click="acceptDelete"
       >
         I understand, and I want to delete this workspace
@@ -30,7 +40,7 @@
 
         <button
           class="btn btn-danger"
-          :disabled="attestation !== 'delete'"
+          :disabled="!isLead || attestation !== 'delete'"
           @click="submitDelete"
         >
           Delete this workspace
@@ -48,18 +58,27 @@ import { workspacesClient } from '~/services/index';
 import type { Workspace } from '~/types/workspaces';
 
 const workspace = inject<Workspace>('workspace')!;
+const { isLead } = useWorkspaceRole();
 
 const accepted = ref(false);
 const attestation = ref('');
 const input = useTemplateRef<HTMLInputElement>('input');
 
 async function acceptDelete() {
+  if (!isLead.value) {
+    return;
+  }
+
   accepted.value = true;
   await nextTick();
   input.value!.focus();
 }
 
 async function submitDelete() {
+  if (!isLead.value) {
+    return;
+  }
+
   await workspacesClient.deleteWorkspace(workspace.id);
   navigateTo('/dashboard');
 }
diff --git a/components/settings/panel/General.vue b/components/settings/panel/General.vue
index f3ea6f6..5ff13a9 100644
--- a/components/settings/panel/General.vue
+++ b/components/settings/panel/General.vue
@@ -1,18 +1,29 @@
 <template>
   <section class="card mb-4">
     <div class="card-body">
+      <b-alert
+        v-if="!isLead"
+        variant="info"
+        show
+        class="mb-3"
+      >
+        <app-icon variant="info" />
+        Only workspace owners can rename the workspace.
+      </b-alert>
       <form @submit.prevent="rename">
         <label class="d-block mb-3">
           Workspace Title
           <input
             v-model.trim="workspaceName"
             class="form-control"
+            :disabled="!isLead"
           >
         </label>
 
         <button
           type="submit"
           class="btn btn-primary"
+          :disabled="!isLead"
         >
           Rename
         </button>
@@ -28,6 +39,7 @@ import { workspacesClient } from '~/services/index';
 import type { Workspace } from '~/types/workspaces';
 
 const workspace = inject<Workspace>('workspace')!;
+const { isLead } = useWorkspaceRole();
 const workspaceName = ref(workspace.title);
 
 async function rename() {
diff --git a/components/settings/panel/Imagery.vue b/components/settings/panel/Imagery.vue
index e19461a..074cf5e 100644
--- a/components/settings/panel/Imagery.vue
+++ b/components/settings/panel/Imagery.vue
@@ -8,6 +8,16 @@
         Custom Imagery
       </h3>
 
+      <b-alert
+        v-if="!isLead"
+        variant="info"
+        show
+        class="mb-3"
+      >
+        <app-icon variant="info" />
+        Only workspace owners can change imagery settings.
+      </b-alert>
+
       <label class="d-block form-label">
         Imagery JSON Definition
         <textarea
@@ -16,6 +26,7 @@
           :class="{ 'drag-over': isDraggingImagery }"
           rows="5"
           placeholder="Optional"
+          :disabled="!isLead"
           @dragover.prevent="isDraggingImagery = true"
           @dragleave.prevent="isDraggingImagery = false"
           @drop.prevent="onImageryFileDrop"
@@ -51,6 +62,7 @@
       <button
         type="submit"
         class="btn btn-primary"
+        :disabled="!isLead"
       >
         Save
       </button>
@@ -73,6 +85,7 @@ import { handleFileDrop, validateJson } from '~/util/schema';
 import type { Workspace } from '~/types/workspaces';
 
 const workspace = inject<Workspace>('workspace')!;
+const { isLead } = useWorkspaceRole();
 
 const imagerySchemaUrl = import.meta.env.VITE_IMAGERY_SCHEMA;
 const imageryExampleUrl = import.meta.env.VITE_IMAGERY_EXAMPLE_URL;
@@ -114,7 +127,7 @@ async function saveImageryConfiguration() {
   }
 
   try {
-    workspacesClient.updateWorkspace(workspace.id, {
+    await workspacesClient.updateWorkspace(workspace.id, {
       imageryListDef: imageryResult.data,
     });
     imagerySaveStatus.value = { type: 'success', message: 'Changes saved.' };
diff --git a/components/teams/Item.vue b/components/teams/Item.vue
index 8a231a5..e714b49 100644
--- a/components/teams/Item.vue
+++ b/components/teams/Item.vue
@@ -21,6 +21,7 @@
     </div>
     <div class="align-self-center flex-shrink-0 ms-auto">
       <button
+        v-if="props.isLead"
         class="btn px-1"
         @click="openSettings"
       >
@@ -41,6 +42,7 @@
         <span class="visually-hidden">View QR Code</span>
       </button>
       <button
+        v-if="props.isLead"
         class="btn ms-1 px-1 text-danger"
         @click="remove"
       >
@@ -59,6 +61,7 @@ import type { WorkspaceTeam } from '~/types/workspaces';
 
 interface Props {
   team: WorkspaceTeam;
+  isLead: boolean;
 }
 
 const props = defineProps<Props>();
diff --git a/components/teams/MembersDialog.vue b/components/teams/MembersDialog.vue
index 5f94a52..249fa40 100644
--- a/components/teams/MembersDialog.vue
+++ b/components/teams/MembersDialog.vue
@@ -29,6 +29,7 @@
 
         <div class="align-self-center flex-shrink-0 ms-auto">
           <button
+            v-if="isLead"
             class="btn ms-1 px-1 py-0 text-danger"
             @click="remove(user)"
           >
@@ -58,6 +59,7 @@ interface Props {
 
 const props = defineProps<Props>();
 const workspace = inject<Workspace>('workspace')!;
+const { isLead } = useWorkspaceRole();
 const { create } = useModal();
 const modal = useTemplateRef<ComponentExposed<typeof BModal>>('modal');
 
@@ -85,6 +87,10 @@ async function onTeamChange(team?: WorkspaceTeam) {
 }
 
 async function remove(user: User) {
+  if (!isLead.value) {
+    return;
+  }
+
   const value = await create({
     body: `Remove ${user.display_name} from "${props.team!.name}"?`,
     title: 'Remove Team Member',
diff --git a/composables/useWorkspaceRole.ts b/composables/useWorkspaceRole.ts
new file mode 100644
index 0000000..d3dda66
--- /dev/null
+++ b/composables/useWorkspaceRole.ts
@@ -0,0 +1,25 @@
+import type { Workspace, WorkspaceRole } from '~/types/workspaces';
+
+/**
+ * Provides role-checking helpers for the current workspace. Requires a parent
+ * component to call:
+ *
+ *   provide('workspace', workspace).
+ *
+ */
+export function useWorkspaceRole() {
+  const workspace = inject<Workspace>('workspace');
+
+  if (import.meta.dev && !workspace) {
+    console.warn(
+      'useWorkspaceRole: no workspace injected.',
+      'A parent component must call provide("workspace", workspace).',
+    );
+  }
+
+  const role = computed<WorkspaceRole | undefined>(() => workspace?.role);
+  const isLead = computed(() => role.value === 'lead');
+  const isValidator = computed(() => role.value === 'validator' || isLead.value);
+
+  return { role, isLead, isValidator };
+}
diff --git a/pages/dashboard.vue b/pages/dashboard.vue
index f4cc716..1a0e54f 100644
--- a/pages/dashboard.vue
+++ b/pages/dashboard.vue
@@ -30,13 +30,19 @@
       </div><!-- .col-md -->
 
       <div class="col-md workspace-details-col">
-        <div class="card" :style="currentWorkspace ? '' : 'visibility: hidden'">
+        <div
+          v-if="currentWorkspace"
+          class="card"
+        >
           <nav class="card-header">
             <dashboard-toolbar :workspace="currentWorkspace" />
           </nav>
 
           <dashboard-map :workspace="currentWorkspace" @center-loaded="onCenterLoaded" />
-          <dashboard-details-table :workspace="currentWorkspace" />
+          <dashboard-details-table
+            :workspace="currentWorkspace"
+            :my-tdei-roles="currentWorkspaceTdeiRoles"
+          />
         </div><!-- .card -->
       </div><!-- .col-md -->
     </div><!-- .row -->
@@ -44,22 +50,36 @@
 </template>
 
 <script lang="ts">
+import { tdeiUserClient, workspacesClient } from '~/services/index';
+import { compareWorkspaceCreatedAtDesc } from '~/services/workspaces';
+import type { Workspace } from '~/types/workspaces';
+
 let lastProjectGroupId: string;
 let lastWorkspaceId: number;
 </script>
 
 <script setup lang="ts">
-import { workspacesClient } from '~/services/index';
-import { compareWorkspaceCreatedAtDesc } from '~/services/workspaces';
-
 const route = useRoute();
 
-const workspaces = (await workspacesClient.getMyWorkspaces()).sort(compareWorkspaceCreatedAtDesc);
+const [workspaces, myProjectGroups] = await Promise.all([
+  workspacesClient.getMyWorkspaces().then(ws => ws.sort(compareWorkspaceCreatedAtDesc)),
+  tdeiUserClient.getMyProjectGroups(),
+]);
+const rolesByProjectGroup = new Map(myProjectGroups.map(pg => [pg.tdei_project_group_id, pg.roles]));
 const workspacesByProjectGroup = Map.groupBy(workspaces, w => w.tdeiProjectGroupId);
 
-const currentProjectGroup = ref(null);
-const currentWorkspace = ref({});
-const currentWorkspaces = computed(() => workspacesByProjectGroup.get(currentProjectGroup.value));
+const currentProjectGroup = ref<string>();
+const currentWorkspace = ref<Workspace>();
+const currentWorkspaces = computed(() =>
+  currentProjectGroup.value
+    ? workspacesByProjectGroup.get(currentProjectGroup.value)
+    : undefined,
+);
+const currentWorkspaceTdeiRoles = computed(() =>
+  currentWorkspace.value
+    ? rolesByProjectGroup.get(currentWorkspace.value.tdeiProjectGroupId) ?? []
+    : [],
+);
 
 for (const w of workspaces) {
   if (w.tdeiMetadata?.length > 0) {
@@ -68,7 +88,7 @@ for (const w of workspaces) {
 }
 
 onMounted(() => {
-  watch(currentWorkspace, (val) => { lastWorkspaceId = val.id });
+  watch(currentWorkspace, (val) => { lastWorkspaceId = val?.id });
   watch(currentProjectGroup, (val) => { lastProjectGroupId = val });
   watch(currentWorkspaces, onCurrentWorkspacesChange);
 
@@ -105,16 +125,17 @@ function autoSelectPreferredView() {
 
 async function onCurrentWorkspacesChange(val) {
   if (val?.length > 0) {
-    if (val[0].tdeiProjectGroupId !== currentWorkspace.value.tdeiProjectGroupId) {
+    if (val[0].tdeiProjectGroupId !== currentWorkspace.value?.tdeiProjectGroupId) {
       await selectWorkspace(val[0]);
     }
-  } else {
-    currentWorkspace.value = {};
+  }
+  else {
+    currentWorkspace.value = undefined;
   }
 }
 
 function onCenterLoaded(center) {
-  currentWorkspace.value.center = center;
+  currentWorkspace.value!.center = center;
 }
 
 async function selectWorkspace(workspace) {
diff --git a/pages/workspace/[id]/export/tdei.vue b/pages/workspace/[id]/export/tdei.vue
index 45407dc..70728cf 100644
--- a/pages/workspace/[id]/export/tdei.vue
+++ b/pages/workspace/[id]/export/tdei.vue
@@ -3,11 +3,42 @@
     <div class="text-center mt-5">
       <app-icon variant="drive_folder_upload" size="48" />
     </div>
-    <h1 class="mb-5 text-center">Export Workspace to TDEI</h1>
+    <h1 class="mb-5 text-center">
+      Export Workspace to the TDEI
+    </h1>
 
     <div class="row row-cols-1 row-cols-md-2 g-4">
       <div class="col mx-auto">
-        <div v-if="workspace.type === 'pathways' && !workspace.tdeiRecordId" class="card">
+        <div
+          v-if="!canExport"
+          class="card"
+        >
+          <div class="card-body">
+            <p>
+              You don't have permission to export this workspace to the TDEI.
+              Exporting requires a <strong>POC</strong> or
+              <strong>{{ dataGeneratorRole }}</strong> role
+              in at least one TDEI project group.
+            </p>
+            <p class="mb-0">
+              Contact your TDEI project group POC to request the appropriate role.
+            </p>
+          </div>
+          <div class="card-footer">
+            <nuxt-link
+              to="../export"
+              class="btn btn-primary"
+            >
+              <app-icon
+                variant="arrow_circle_left"
+                no-margin
+              />
+              Go back
+            </nuxt-link>
+          </div>
+        </div>
+
+        <div v-else-if="workspace.type === 'pathways' && !workspace.tdeiRecordId" class="card">
           <div class="card-body">
             <p>
               This GTFS Pathways workspace is not derived from a TDEI dataset and
@@ -15,7 +46,10 @@
             </p>
           </div>
           <div class="card-footer">
-            <nuxt-link to="../" class="btn btn-primary">
+            <nuxt-link
+              to="../export"
+              class="btn btn-primary"
+            >
               <app-icon variant="arrow_circle_left" no-margin />
               Go back
             </nuxt-link>
@@ -30,7 +64,10 @@
             </label>
             <label class="d-block mt-3">
               Project Group
-              <project-group-picker v-model="workspace.tdeiProjectGroupId" />
+              <project-group-picker
+                v-model="workspace.tdeiProjectGroupId"
+                :options="eligibleProjectGroups"
+              />
             </label>
             <label class="d-block mt-3">
               Service
@@ -75,7 +112,7 @@
 </template>
 
 <script setup lang="ts">
-import { osmClient, tdeiClient, workspacesClient } from '~/services/index'
+import { osmClient, tdeiClient, tdeiUserClient, workspacesClient } from '~/services/index';
 import { TdeiExporter, TdeiExporterContext } from '~/services/export/tdei'
 import { toast } from 'vue3-toastify';
 import 'vue3-toastify/dist/index.css';
@@ -84,8 +121,24 @@ const context = reactive(new TdeiExporterContext());
 const exporter = new TdeiExporter(tdeiClient, osmClient, context);
 
 const route = useRoute();
-const workspaceId = route.params.id;
-const workspace = reactive(await workspacesClient.getWorkspace(workspaceId));
+const workspaceId = Number(route.params.id);
+
+const [workspace, myProjectGroups] = await Promise.all([
+  workspacesClient.getWorkspace(workspaceId),
+  tdeiUserClient.getMyProjectGroups(),
+]);
+
+const dataGeneratorRole = `${workspace.type}_data_generator`;
+const eligibleProjectGroups = myProjectGroups.filter(pg =>
+  pg.roles.includes('poc') || pg.roles.includes(dataGeneratorRole),
+);
+const canExport = eligibleProjectGroups.length > 0;
+
+// Default to the workspace's own PG if eligible, otherwise first eligible PG:
+if (canExport && !eligibleProjectGroups.some(pg => pg.tdei_project_group_id === workspace.tdeiProjectGroupId)) {
+  workspace.tdeiProjectGroupId = eligibleProjectGroups[0]!.tdei_project_group_id;
+}
+
 const oldMetadata = workspace.tdeiMetadata ? JSON.parse(workspace.tdeiMetadata) : {};
 
 const datasetName = ref(workspace.title);
@@ -109,7 +162,7 @@ async function upload() {
 
   if (jobId) {
     // TODO: show a more helpful message
-    toast.info(`TDEI import job ${jobId} created sucessfully.`);
+    toast.info(`TDEI import job ${jobId} created successfully.`);
     navigateTo('/dashboard');
   }
 }
diff --git a/pages/workspace/[id]/review.vue b/pages/workspace/[id]/review.vue
index 0b5bbd6..220144b 100644
--- a/pages/workspace/[id]/review.vue
+++ b/pages/workspace/[id]/review.vue
@@ -52,7 +52,7 @@
 </template>
 
 <script setup lang="ts">
-import { reviewManager } from '~/services/index';
+import { reviewManager, workspacesClient } from '~/services/index';
 
 import type ReviewMap from '~/components/review/Map.vue';
 import type { ReviewListItem } from '~/services/review.ts';
@@ -61,6 +61,9 @@ import type { AdiffAction } from '~/types/adiff';
 const route = useRoute();
 const workspaceId = Number(route.params.id);
 
+const workspace = await workspacesClient.getWorkspace(workspaceId);
+provide('workspace', workspace);
+
 const reviewList = reviewManager.getList(workspaceId);
 const filter = reactive(reviewManager.getFilter());
 
diff --git a/pages/workspace/[id]/settings/members.vue b/pages/workspace/[id]/settings/members.vue
new file mode 100644
index 0000000..b26b5be
--- /dev/null
+++ b/pages/workspace/[id]/settings/members.vue
@@ -0,0 +1,275 @@
+<template>
+  <b-col lg="8">
+    <b-alert
+      v-if="accessDenied"
+      variant="info"
+      show
+      class="mb-4"
+    >
+      <app-icon variant="info" />
+      You need a TDEI POC role in this project group to view and manage
+      workspace member roles.
+    </b-alert>
+
+    <h3 class="border-bottom pb-2">
+      Project Group Admins
+      <app-icon
+        variant="local_police"
+        size="24"
+      />
+    </h3>
+    <p class="mt-3 mb-4">
+      TDEI project group admins (POCs) have full control of the workspace and
+      all workspace settings.
+    </p>
+    <b-list-group
+      v-if="pocs.length"
+      class="mb-5"
+    >
+      <b-list-group-item
+        v-for="m in pocs"
+        :key="m.user_id"
+        class="d-flex align-items-center"
+      >
+        <div class="me-auto">
+          <app-icon
+            variant="person"
+            class="d-none d-sm-inline"
+          />
+          {{ m.first_name }} {{ m.last_name }}
+        </div>
+        <b-badge>
+          <app-icon variant="lock" /> poc
+        </b-badge>
+      </b-list-group-item>
+    </b-list-group>
+    <b-alert
+      v-else
+      class="mb-5"
+      variant="light"
+      show
+    >
+      <app-icon variant="info" />
+      No one has a TDEI POC role in this project group.
+    </b-alert>
+
+    <h3 class="border-bottom pb-2">
+      Data Generators
+      <app-icon
+        variant="offline_bolt"
+        size="24"
+      />
+    </h3>
+    <p class="mt-3 mb-4">
+      Members with a TDEI data generator role can export workspace data to the
+      TDEI.
+    </p>
+    <b-list-group
+      v-if="generators.length"
+      class="mb-5"
+    >
+      <b-list-group-item
+        v-for="m in generators"
+        :key="m.user_id"
+        class="d-flex align-items-center"
+      >
+        <div class="me-auto">
+          <app-icon
+            variant="person"
+            class="d-none d-sm-inline"
+          />
+          {{ m.first_name }} {{ m.last_name }}
+        </div>
+        <template
+          v-for="role in m.roles"
+          :key="role"
+        >
+          <b-badge
+            v-if="role.endsWith('_data_generator')"
+            class="ms-1"
+          >
+            <app-icon variant="lock" /> {{ formatDataGeneratorRole(role) }}
+          </b-badge>
+        </template>
+      </b-list-group-item>
+    </b-list-group>
+    <b-alert
+      v-else
+      class="mb-5"
+      variant="light"
+      show
+    >
+      <app-icon variant="info" />
+      No one has a TDEI data generator role in this project group.
+    </b-alert>
+
+    <h3 class="border-bottom pb-2">
+      Workspace Members
+      <app-icon
+        variant="edit_location_alt"
+        size="24"
+      />
+    </h3>
+    <p class="mt-3">
+      Members of the TDEI project group can access and modify data in this
+      workspace. Those with the following roles have additional privileges:
+    </p>
+    <ul class="mb-4">
+      <li><strong>Owner</strong> can review changesets and modify workspace settings</li>
+      <li><strong>Validator</strong> can review changesets</li>
+    </ul>
+    <b-list-group v-if="members.length">
+      <b-list-group-item
+        v-for="m in members"
+        :key="m.user_id"
+        class="d-flex align-items-center"
+      >
+        <div class="me-auto">
+          <app-icon
+            variant="person"
+            class="d-none d-sm-inline"
+          />
+          {{ m.first_name }} {{ m.last_name }}
+        </div>
+
+        <!-- Lead: functional role dropdown -->
+        <b-dropdown
+          v-if="isLead"
+          variant="light"
+          size="sm"
+          :text="roleLabel(m.localRole)"
+          placement="bottom-end"
+        >
+          <b-dropdown-item @click="setRole(m, 'lead')">
+            <app-icon
+              variant="check"
+              :class="m.localRole === 'lead' ? '' : 'invisible'"
+            />
+            Owner
+          </b-dropdown-item>
+          <b-dropdown-item @click="setRole(m, 'validator')">
+            <app-icon
+              variant="check"
+              :class="m.localRole === 'validator' ? '' : 'invisible'"
+            />
+            Validator
+          </b-dropdown-item>
+          <b-dropdown-item @click="setRole(m, undefined)">
+            <app-icon
+              variant="check"
+              :class="!m.localRole ? '' : 'invisible'"
+            />
+            Member
+          </b-dropdown-item>
+        </b-dropdown>
+
+        <!-- Non-lead: read-only role badge -->
+        <b-badge
+          v-else
+          variant="secondary"
+        >
+          {{ roleLabel(m.localRole) }}
+        </b-badge>
+      </b-list-group-item>
+    </b-list-group>
+    <b-alert
+      v-else
+      class="mb-5"
+      variant="light"
+      show
+    >
+      <app-icon variant="info" />
+      There are no unprivileged members in this project group.
+    </b-alert>
+  </b-col>
+</template>
+
+<script setup lang="ts">
+import { toast } from 'vue3-toastify';
+import { WorkspacesClientError } from '~/services/workspaces';
+import { TdeiUserClientError } from '~/services/tdei';
+import { tdeiUserClient, workspacesClient } from '~/services/index';
+import { ROLE_LABELS } from '~/util/roles';
+import type { Workspace, WorkspaceRole } from '~/types/workspaces';
+import type { TdeiUserItem } from '~/types/tdei';
+
+interface MemberEntry {
+  user_id: string;
+  first_name: string;
+  last_name: string;
+  localRole?: WorkspaceRole;
+}
+
+const workspace = inject<Workspace>('workspace')!;
+const { isLead } = useWorkspaceRole();
+
+let projectGroupUsers: TdeiUserItem[] = [];
+let accessDenied = false;
+
+try {
+  projectGroupUsers = await tdeiUserClient.getProjectGroupUsers(workspace.tdeiProjectGroupId);
+}
+catch (e) {
+  if (e instanceof TdeiUserClientError && e.response.status === 403) {
+    accessDenied = true;
+  }
+  else {
+    throw e;
+  }
+}
+
+const localRoleMap = new Map<string, WorkspaceRole>();
+
+if (isLead.value) {
+  const wsMembers = await workspacesClient.getWorkspaceMembers(workspace.id);
+  for (const m of wsMembers) {
+    localRoleMap.set(m.user.auth_uid, m.role);
+  }
+}
+
+const pocs = projectGroupUsers.filter(u => u.roles.includes('poc'));
+const generators = projectGroupUsers.filter(
+  u => u.roles.some((r: string) => r.endsWith('_data_generator')),
+);
+const members = ref<MemberEntry[]>(
+  projectGroupUsers
+    .filter((u: TdeiUserItem) => !u.roles?.includes('poc'))
+    .map((u: TdeiUserItem) => ({
+      user_id: u.user_id,
+      first_name: u.first_name,
+      last_name: u.last_name,
+      localRole: localRoleMap.get(u.user_id),
+    })),
+);
+
+function roleLabel(role?: WorkspaceRole): string {
+  return role ? ROLE_LABELS[role] : ROLE_LABELS.contributor;
+}
+
+function formatDataGeneratorRole(role: string) {
+  const index = role.indexOf('_');
+  return role.substring(0, index);
+}
+
+async function setRole(member: MemberEntry, role?: WorkspaceRole) {
+  if (role === member.localRole) return;
+
+  try {
+    if (!role) {
+      await workspacesClient.removeRole(workspace.id, member.user_id);
+    }
+    else {
+      await workspacesClient.assignRole(workspace.id, member.user_id, role);
+    }
+    member.localRole = role;
+  }
+  catch (e) {
+    if (e instanceof WorkspacesClientError && e.response.status === 404) {
+      toast.error('This member has never signed in to Workspaces and cannot be assigned a role yet.');
+    }
+    else {
+      toast.error(e instanceof Error ? e.message : 'Failed to update role');
+    }
+  }
+}
+</script>
diff --git a/pages/workspace/[id]/settings/teams/index.vue b/pages/workspace/[id]/settings/teams/index.vue
index 0b3df9f..f4d7788 100644
--- a/pages/workspace/[id]/settings/teams/index.vue
+++ b/pages/workspace/[id]/settings/teams/index.vue
@@ -4,15 +4,34 @@
       <h3 class="mb-0">
         Teams
       </h3>
-      <b-button
-        variant="primary"
-        class="flex-shrink-0"
-        @click="openNewDialog"
+      <b-popover
+        content="Only workspace owners can create teams"
+        :manual="isLead"
       >
-        <app-icon variant="add" /> New Team
-      </b-button>
+        <template #target>
+          <div class="d-inline-block">
+            <b-button
+              variant="primary"
+              class="flex-shrink-0"
+              :disabled="!isLead"
+              @click="openNewDialog"
+            >
+              <app-icon variant="add" /> New Team
+            </b-button>
+          </div>
+        </template>
+      </b-popover>
     </div>
 
+    <b-alert
+      v-if="!isLead"
+      variant="info"
+      show
+      class="mb-3"
+    >
+      <app-icon variant="info" />
+      Only workspace owners can create, rename, or delete teams.
+    </b-alert>
     <b-alert
       v-if="!teams.length"
       variant="info"
@@ -27,6 +46,7 @@
         v-for="team in teams"
         :key="team.id"
         :team="team"
+        :is-lead="isLead"
         @join="openJoinDialog"
         @open-settings="openSettingsDialog"
         @remove="remove"
@@ -61,6 +81,7 @@ import type TeamsMembersDialog from '~/components/teams/MembersDialog.vue';
 import type TeamsSettingsDialog from '~/components/teams/SettingsDialog.vue';
 import type { WorkspaceTeam } from '~/types/workspaces';
 
+const { isLead } = useWorkspaceRole();
 const { create } = useModal();
 const route = useRoute();
 const workspaceId = Number(route.params.id);
diff --git a/services/tdei.ts b/services/tdei.ts
index 6f0535d..4746e7e 100644
--- a/services/tdei.ts
+++ b/services/tdei.ts
@@ -2,7 +2,11 @@ import { BlobReader, BlobWriter, ZipReader } from '@zip.js/zip.js';
 
 import { BaseHttpClient, BaseHttpClientError } from '~/services/http';
 import type { ICancelableClient } from '~/services/loading';
-import type { TdeiFeedback } from '~/types/tdei.ts';
+import type {
+  TdeiFeedback,
+  TdeiProjectGroup,
+  TdeiUserItem,
+} from '~/types/tdei.ts';
 
 const MIN_TOKEN_REFRESH_MS = 10 * 1000;
 
@@ -443,15 +447,36 @@ export class TdeiUserClient extends BaseHttpClient implements ICancelableClient
     return this.#auth;
   }
 
-  clone(signal?: AbortSignal) {
-    return new TdeiClient(this._baseUrl, this.#auth, signal ?? this._abortSignal);
+  clone(signal?: AbortSignal): TdeiUserClient {
+    return new TdeiUserClient(this._baseUrl, this.#tdeiClient, signal ?? this._abortSignal);
   }
 
-  async getMyProjectGroups() {
-    const response = await this._get(`project-group-roles/${this.#auth.subject}`);
+  async getMyProjectGroups(): Promise<TdeiProjectGroup[]> {
+    const params = new URLSearchParams({ page_no: '1', page_size: '10000' });
+    const response = await this._get(`project-group-roles/${this.#auth.subject}?${params}`);
+    const pgs = (await response.json()) as {
+      tdei_project_group_id: string;
+      project_group_name: string;
+      roles: string[];
+    }[];
 
-    return (await response.json())
-      .map(p => ({ id: p.tdei_project_group_id, name: p.project_group_name }));
+    return pgs.map(p => ({
+      tdei_project_group_id: p.tdei_project_group_id,
+      name: p.project_group_name,
+      roles: p.roles as string[],
+    }));
+  }
+
+  async getMyRolesForProjectGroup(projectGroupId: string, pgName: string): Promise<string[]> {
+    const params = new URLSearchParams({ searchText: pgName });
+    const response = await this._get(`project-group-roles/${this.#auth.subject}?${params}`);
+    const pgs = (await response.json()) as {
+      tdei_project_group_id: string;
+      project_group_name: string;
+      roles: string[];
+    }[];
+
+    return pgs.find(p => p.tdei_project_group_id === projectGroupId)?.roles ?? [];
   }
 
   async getMyServices(projectGroupId: string, type: string = 'all') {
@@ -461,6 +486,16 @@ export class TdeiUserClient extends BaseHttpClient implements ICancelableClient
       .map(s => ({ id: s.tdei_service_id, name: s.service_name }));
   }
 
+  async getProjectGroupUsers(projectGroupId: string): Promise<TdeiUserItem[]> {
+    const params = new URLSearchParams();
+    params.append('page_no', '1');
+    params.append('page_size', '10000');
+
+    const response = await this._get(`project-group/${projectGroupId}/users?${params}`);
+
+    return await response.json();
+  }
+
   #setAuthHeader() {
     if (this.#auth.complete) {
       this._requestHeaders.Authorization = 'Bearer ' + this.#auth.accessToken;
diff --git a/services/workspaces.ts b/services/workspaces.ts
index 2397ac3..8d3c0a4 100644
--- a/services/workspaces.ts
+++ b/services/workspaces.ts
@@ -13,7 +13,9 @@ import type {
   Workspace,
   WorkspaceCreation,
   WorkspaceId,
+  WorkspaceMember,
   WorkspacePatch,
+  WorkspaceRole,
   WorkspaceTeam,
 } from '~/types/workspaces';
 
@@ -75,7 +77,7 @@ export class WorkspacesClient extends BaseHttpClient implements ICancelableClien
   }
 
   async getMyWorkspaces(): Promise<Workspace[]> {
-    const response = await this._get('workspaces/mine');
+    const response = await this.#newApi._get('workspaces/mine');
     const workspaces = (await response.json()) ?? [];
 
     for (const workspace of workspaces) {
@@ -87,7 +89,7 @@ export class WorkspacesClient extends BaseHttpClient implements ICancelableClien
   }
 
   async getWorkspace(id: WorkspaceId): Promise<Workspace> {
-    const response = await this._get(`workspaces/${id}`);
+    const response = await this.#newApi._get(`workspaces/${id}`);
 
     return await response.json();
   }
@@ -100,17 +102,15 @@ export class WorkspacesClient extends BaseHttpClient implements ICancelableClien
     workspace.createdBy = this.#tdeiClient.auth.subject;
     workspace.createdByName = this.#tdeiClient.auth.displayName;
 
-    const workspaceResponse = await this._post('workspaces', workspace);
+    const workspaceResponse = await this.#newApi._post('workspaces', workspace);
     const workspaceId = (await workspaceResponse.json()).workspaceId;
     await this.#osmClient.createWorkspace(workspaceId);
 
     return workspaceId;
   }
 
-  async updateWorkspace(id: WorkspaceId, workspaceDetails: WorkspacePatch)
-    : Promise<void>
-  {
-    await this._patch(`workspaces/${id}`, workspaceDetails);
+  async updateWorkspace(id: WorkspaceId, workspaceDetails: WorkspacePatch): Promise<void> {
+    await this.#newApi._patch(`workspaces/${id}`, workspaceDetails);
   }
 
   async exportWorkspaceArchive(workspace: Workspace): Promise<Blob> {
@@ -131,25 +131,23 @@ export class WorkspacesClient extends BaseHttpClient implements ICancelableClien
 
   async deleteWorkspace(id: WorkspaceId): Promise<void> {
     await Promise.all([
-      this._delete(`workspaces/${id}`),
-      this.#osmClient.deleteWorkspace(id)
+      this.#newApi._delete(`workspaces/${id}`),
+      this.#osmClient.deleteWorkspace(id),
     ]);
   }
 
   async getLongFormQuestSettings(id: WorkspaceId): Promise<QuestSettings> {
-    const response = await this._get(`workspaces/${id}/quests/long/settings`);
+    const response = await this.#newApi._get(`workspaces/${id}/quests/long/settings`);
 
     return await response.json();
   }
 
-  async saveLongFormQuestSettings(id: WorkspaceId, settings: QuestSettingsPatch)
-    : Promise<void>
-  {
-    await this._patch(`workspaces/${id}/quests/long/settings`, settings);
+  async saveLongFormQuestSettings(id: WorkspaceId, settings: QuestSettingsPatch): Promise<void> {
+    await this.#newApi._patch(`workspaces/${id}/quests/long/settings`, settings);
   }
 
   async saveImageryDefSettings(workspaceId: number, settings: object): Promise<void> {
-    await this._patch(`workspaces/${workspaceId}/imagery/settings`, settings);
+    await this.#newApi._patch(`workspaces/${workspaceId}/imagery/settings`, settings);
   }
 
   async getTeams(id: WorkspaceId): Promise<WorkspaceTeam[]> {
@@ -202,6 +200,28 @@ export class WorkspacesClient extends BaseHttpClient implements ICancelableClien
     await this.#newApi._delete(`workspaces/${id}/teams/${teamId}/members/${userId}`);
   }
 
+  async getWorkspaceMembers(id: WorkspaceId): Promise<WorkspaceMember[]> {
+    const response = await this.#newApi._get(`workspaces/${id}/users`);
+    const items: Array<User & { role: WorkspaceRole }> = await response.json();
+    return items.map(item => ({
+      user: {
+        id: item.id,
+        auth_uid: item.auth_uid,
+        email: item.email,
+        display_name: item.display_name,
+      },
+      role: item.role,
+    }));
+  }
+
+  async assignRole(id: WorkspaceId, userUuid: string, role: WorkspaceRole): Promise<void> {
+    await this.#newApi._put(`workspaces/${id}/users/${userUuid}/role`, { role });
+  }
+
+  async removeRole(id: WorkspaceId, userUuid: string): Promise<void> {
+    await this.#newApi._delete(`workspaces/${id}/users/${userUuid}`);
+  }
+
   #setAuthHeader() {
     if (this.#tdeiClient.auth.complete) {
       this._requestHeaders.Authorization = 'Bearer ' + this.auth.accessToken;
diff --git a/types/tdei.ts b/types/tdei.ts
index 3a01edd..9bb7d88 100644
--- a/types/tdei.ts
+++ b/types/tdei.ts
@@ -1,13 +1,29 @@
+export type TdeiRoleAssignment = string;
+
 export interface TdeiProjectGroupItem {
   tdei_project_group_id: string;
   name: string;
 }
 
+export interface TdeiProjectGroup extends TdeiProjectGroupItem {
+  roles: TdeiRoleAssignment[];
+}
+
 export interface TdeiDatasetItem {
   tdei_dataset_id: string;
   name: string;
 }
 
+export interface TdeiUserItem {
+  user_id: string;
+  first_name: string;
+  last_name: string;
+  email: string;
+  username: string;
+  phone: string;
+  roles: TdeiRoleAssignment[];
+}
+
 export interface TdeiFeedback {
   id: number;
   status: string;
diff --git a/types/workspaces.ts b/types/workspaces.ts
index 0b0a08e..11f1196 100644
--- a/types/workspaces.ts
+++ b/types/workspaces.ts
@@ -1,6 +1,7 @@
 export type WorkspaceId = number;
 export type WorkspaceType = 'osw' | 'pathways';
 export type WorkspaceAppAccess = 0 | 1 | 2;
+export type WorkspaceRole = 'lead' | 'validator' | 'contributor';
 
 export interface Workspace {
   id: WorkspaceId;
@@ -16,6 +17,7 @@ export interface Workspace {
   createdByName: string;
   externalAppAccess: WorkspaceAppAccess;
   kartaViewToken?: string;
+  role?: WorkspaceRole;
 }
 
 export interface WorkspaceCreation {
@@ -63,3 +65,8 @@ export interface User {
   email: string;
   display_name: string;
 }
+
+export interface WorkspaceMember {
+  user: User;
+  role: WorkspaceRole;
+}
diff --git a/util/roles.ts b/util/roles.ts
new file mode 100644
index 0000000..fd91a52
--- /dev/null
+++ b/util/roles.ts
@@ -0,0 +1,7 @@
+import type { WorkspaceRole } from '~/types/workspaces'
+
+export const ROLE_LABELS: Record<WorkspaceRole, string> = {
+  lead: 'Owner',
+  validator: 'Validator',
+  contributor: 'Member',
+}