Team & Roles

An organization is a shared space — agents, integrations, secrets, traces, and billing all live inside it. Access works at two levels: a member's organization role sets their baseline, and agent collaborators can grant tighter or looser access on individual agents.

Invite a teammate

1. Open Settings → Team Management.
2. Click Invite Member.
3. Enter their email and pick a role.
4. Send Invitation.

The invitee gets an email link that auto-creates their account if they don't already have one.

Organization roles

Five built-in organization roles form a capability ladder:

• Owner — everything an Admin can do, plus organization deletion and managing other Owners. Every organization must retain at least one Owner.
• Admin — manage members, billing, secrets, keys, and organization settings.
• Developer — build, test, configure, and deploy agents and integrations.
• Operator — run deployed agents and approve actions without changing configuration.
• Viewer — read-only access to dashboards, traces, and configuration.

Use Admin and Owner sparingly. Owner cannot be selected while inviting someone; an existing Owner promotes an active member through the confirmed Make Owner action.

Agent collaborators

Each agent has its own collaborator list with three roles:

• Admin — full control over the agent, including managing collaborators on it.
• Editor — build, edit prompts and flow, attach tools and knowledge, and deploy.
• Viewer — read-only access to the agent, traces, and conversations.

Effective access is the intersection of both levels: the organization role must grant the required capability, and the collaborator role must grant access to that agent. Organization Admins and Owners have implicit Admin access to every agent.

Manage members

In Team Management you can:

• Change role — assign Viewer, Operator, Developer, or Admin.
• Make/Remove Owner — Owners can add other Owners or remove Owner access, provided at least one Owner remains.
• Remove — immediately removes membership, revokes personal API keys, and removes agent grants.
• Resend invitation — for invitations that expired before acceptance.
• Revoke pending invitation — pulls back an unaccepted invite.

What members share

Everything in an organization is potentially accessible — agents, integrations, secrets, knowledge base, traces, conversations, evaluations — subject to org and per-agent collaborator roles.

If you need hard isolation between teams or environments, use separate organizations. A user can belong to many organizations and switch between them.

Multi-organization patterns

Best practices

• Treat team management as security. Removing a departing teammate is a security action — do it the same day.
• Don't share accounts. Every human gets their own login.
• Use service accounts for automation. Don't burn a human seat on a script or production workload. (Service Accounts)

Next steps

• Settings — organization-wide configuration
• Security — encryption, isolation, compliance
• Tokens and Service Accounts — programmatic access