> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rewind.codes/llms.txt
> Use this file to discover all available pages before exploring further.

# Organization

> Members, invitations, roles and API keys: who may see and do what.

Open your organization from the account menu at the bottom of the sidebar. Each part is shown to whoever holds its
permission, and the roles offered are those you may give.

## Members

Everyone in the organization, with their status, their role, the labels they are limited to, and who granted them
access. **Change role** changes a grant; **Remove** removes a member. You may change only a member whose permissions you
hold yourself, and the organization always keeps an owner.

![The members of an organization with their role and allowed labels](https://mintcdn.com/rewind/WThuBH7lRjVmKt9-/images/dashboard/organization-members-light.webp?fit=max\&auto=format\&n=WThuBH7lRjVmKt9-\&q=85\&s=54d977a00add35b006bc46a188259f0c)

**Allowed labels** limit a member to the runs carrying them: a member limited to `agent:triage` sees only that agent's
runs, everywhere in the dashboard.

## Invitations

Invite an email with a role and, optionally, labels. Resend or revoke a pending invitation. The invitation link signs
the person in and lands them in the organization.

## Roles

A role is a set of permissions. The built-in roles never change; your organization can add its own.

![The organization's roles and the built-in roles with their permissions](https://mintcdn.com/rewind/WThuBH7lRjVmKt9-/images/dashboard/organization-roles-light.webp?fit=max\&auto=format\&n=WThuBH7lRjVmKt9-\&q=85\&s=89a319a3e900626f9e37a661eac4276b)

| Built-in role | For |
| - | - |
| `owner` | Every permission: administers the organization |
| `harness` | A harness and its agent tools: runs, toolsets, credentials, tasks, subscriptions, namespaces and tokens |
| `worker` | A host-tool worker only: `tasks:work` |
| `reader` | Reading runs, toolsets, subscriptions, members and roles: a dashboard |

| Permissions | Allow |
| - | - |
| `runs:read`, `runs:start`, `runs:control`, `runs:quarantine`, `runs:delete` | Reading runs; starting them; signalling, cancelling and forking them; releasing them from quarantine; erasing them |
| `toolsets:read`, `toolsets:write`, `credentials:write` | Reading and registering toolsets and workflows; setting credentials |
| `tasks:work`, `tasks:approve` | Executing host tools; approving and rejecting calls |
| `subscriptions:read`, `subscriptions:write` | Webhook subscriptions |
| `namespaces:read`, `namespaces:write`, `tokens:write` | The end users: reading them; their limits and erasure; minting and revoking their tokens |
| `members:read`, `members:invite`, `members:manage` | The members: reading, inviting, changing and removing them |
| `roles:read`, `roles:write` | The roles |
| `api_keys:read`, `api_keys:write` | The API keys |
| `organization:write` | The organization's settings |

## API keys

Keys call the API with the role of their grant, and a key limited to labels sees only the runs carrying them. Each key
shows its role, its labels, who created it and when, and its state.

![The organization's API keys with their roles, creators and states](https://mintcdn.com/rewind/WThuBH7lRjVmKt9-/images/dashboard/organization-api-keys-light.webp?fit=max\&auto=format\&n=WThuBH7lRjVmKt9-\&q=85\&s=570aebc4855b998234633afcf155881b)

**New key** asks for a name, a role and optional labels. The secret is shown once: copy it before you close the panel.
**Revoke** refuses the key from then on.

> [!TIP]
>
> Give each process the smallest role it needs: `harness` for your backend, `worker` for a host-tool worker, a key
> limited to an agent's labels for that agent's tools. End users' agents get [tokens](https://docs.rewind.codes/sdk/end-users.md#tokens), not keys.

## Settings

The organization's name, and the default role of the people who join it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.