You can add an internal user to or remove a user from a workspace with the User Administrator role.