Skip to main content
Open your organization from the account menu at the bottom of the sidebar. Each part is shown to whoever holds its permission, and the roles offered are those you may give.

Members

Everyone in the organization, with their status, their role, the labels they are limited to, and who granted them access. Change role changes a grant; Remove removes a member. You may change only a member whose permissions you hold yourself, and the organization always keeps an owner.
The members of an organization with their role and allowed labelsThe members of an organization with their role and allowed labels
Allowed labels limit a member to the runs carrying them: a member limited to agent:triage sees only that agent’s runs, everywhere in the dashboard.

Invitations

Invite an email with a role and, optionally, labels. Resend or revoke a pending invitation. The invitation link signs the person in and lands them in the organization.

Roles

A role is a set of permissions. The built-in roles never change; your organization can add its own.
The organization's roles and the built-in roles with their permissionsThe organization's roles and the built-in roles with their permissions

API keys

Keys call the API with the role of their grant, and a key limited to labels sees only the runs carrying them. Each key shows its role, its labels, who created it and when, and its state.
The organization's API keys with their roles, creators and statesThe organization's API keys with their roles, creators and states
New key asks for a name, a role and optional labels. The secret is shown once: copy it before you close the panel. Revoke refuses the key from then on.
Give each process the smallest role it needs: harness for your backend, worker for a host-tool worker, a key limited to an agent’s labels for that agent’s tools. End users’ agents get tokens, not keys.

Settings

The organization’s name, and the default role of the people who join it.