Team and permissions
5 min read
In Team, you invite the people who will work in the organization and define which resources they can manage. On the left is the list of members and pending invitations, with a search box and filters by role, status, two-factor authentication, and join date. Select someone to view and change their role, agent access, and permissions on the right.
Invite someone
Open Team
In the sidebar, go to Organization > Team and select Invite, at the bottom of the list.
Enter their email and role
Enter the person's email address and choose a role or a profile. You can adjust it later.
Send the invitation
The person will receive an email to sign in or create an account. The invitation remains pending until they accept it.
Roles
A role provides a baseline set of permissions. You can then customize each member's permissions on their page. Nobody can assign a role with more access than their own.
| Role | Typical use |
|---|---|
| Owner | Full control of the organization, including its configuration and deletion. |
| Administrator | Manages operations: team, agents, servers, billing, and the activity log. |
| Operator | Works with the resources they have been granted, such as agents, conversations, memories, or tasks. |
| Observer | Can only view the resources and agents assigned to them. |
Start with the minimum access
Assign the most restricted role that lets each person do their work. You can always expand access when needed.
Custom permissions
A role is a starting template. To tailor a member's access, select them in the list: their page includes a matrix where you can enable or remove specific actions. Save with Save. If their permissions no longer match any role, their role shows as Custom. The owner always has full access and their permissions cannot be changed.
Permissions are grouped by the resource they affect:
| Group | Examples of actions |
|---|---|
| Organization and team | View or edit the organization; invite, edit, or remove members. |
| Agents and approvals | Create, configure, or delete agents; view and resolve approvals. |
| Context and tools | Manage memories, skills, MCP tools, connectors, and contact profiles. |
| Credentials and connected services | View, edit, reveal, or assign credentials; manage GitHub and model providers. |
| Operations and infrastructure | Manage servers, scheduled tasks, attachments, backups, and service tokens. |
| Supervision and administration | View conversations, activity, and the communications graph; view or manage billing and support. |
Most groups distinguish between View and Manage, which includes editing and deleting; some also separate Create. Others add specific actions, such as resolving approvals, revealing a credential, sharing a credential or a connector with other people (Share), restoring a backup, or subscribing to a plan.
Some things have no box because every member has them: seeing the organization and support, and, in the agents they can reach, their conversations, activities and attachments.
Review sensitive permissions
Grant permission to Reveal credentials or manage model providers, backups, service tokens, or billing only to people who genuinely need that access.
Profiles
When several people need the same access —for example, a sales team that works with agents but should not create agents, MCP tools, skills, or scheduled tasks—, define a profile once and assign it to all of them.
In Team > Profiles you see the built-in roles, read-only, and the organization's profiles. With New profile you choose a name and the role it builds on (Based on), and adjust the permission matrix.
- Changing a profile's permissions changes them for everyone who has it.
- Editing the permissions of someone with a profile by hand detaches them from it; they keep what they had.
- Deleting a profile leaves its members with their current permissions.
To apply it, pick the profile in the Role selector on each person's page, or when inviting them.
Agent access
Administrators and owners have access to every agent. For operators and observers, access is assigned explicitly in the Agents section of their page:
- Chat lets them use the agent within that person's permissions.
- Manage lets them configure it as well as use it.
- Ask only does not show the agent, but the person gets its answers when another agent passes it a question of theirs.
- No access hides the agent from that person.
The same relationship can be adjusted from each agent's access tab. Granting access to an agent does not automatically reveal credentials or other organization resources.
Review and remove access
From each person's page you can change their role, review their permissions, or remove them with Remove from team, in the menu next to Save. It also shows whether they have two-factor authentication enabled and when they last signed in.
Personal conversations do not become visible to other members simply because they are administrators. To understand visibility for shared threads, see Agent Desk.
Suspend access
If you only want to cut someone's access for a while, use Suspend access in the same menu instead of removing them. While suspended they can't enter the organization, their agents don't answer them on any channel, their scheduled tasks are paused and they can't resolve approvals.
Nothing is deleted: Reactivate gives them back their role, permissions, agent access and credentials as they were. Anyone allowed to remove members can do it. The organization's owner can't be suspended.
Before removing someone
Check the tasks, credentials, or integrations that person may manage. Removing them blocks their access to the organization, but does not automatically reassign those resources.