Projects and access

This page shows you how to manage who can do what: creating projects, adding members, changing roles, and inviting people who don't have an account yet.

The pieces

• An organization (org) is the top level. It owns projects and users. Only platform admins create orgs.
• A project is a private workspace with its own resources, quota, member list, and isolated namespace. Everything you create lives in exactly one project.
• A member holds a role in a project: member (use the project's resources) or admin (also do the irreversible things: delete, reveal secrets, mint credentials, manage members).

Roles live on two separate axes — control over the project object versus control over its contents. The security overview explains this in full; the short version is that a platform admin can rename or delete your project but cannot read anything inside it.

The Projects page

Administration → Projects lists every project you belong to, and lets org admins and platform admins create new ones. A project has:

• a slug — its short lowercase name (for example ml-team),
• a name — the display name,
• a short — a small immutable id used in its namespace and hostnames.

Renaming a project is always safe. The API's own response says why:

the project's short id and namespace are unchanged, so every resource path, hostname and running workload is unaffected

Deleting a project is guarded. The default project cannot be deleted at all, and a project with agents still in it refuses with:

project still has agents - delete them first (this is deliberate: deleting a project would destroy their code and logs)

The Organizations page (platform admins)

Administration → Organizations is where platform admins run the platform:

• Create an org with a slug and name. Delete an empty org — one that still has projects or users refuses with organization still has projects - delete them first or organization still has users - move or remove them first. The default org cannot be deleted.
• The user directory. Create a user account (if you don't set a password, a temporary one is generated and shown once; the user must change it at first sign-in). Change a user's platform role between admin and user, reset their password (again, shown once), or delete the account. Deleting removes their project grants but any agents they deployed keep running.
• Org members (per org): add an existing account by email as member or admin. Org admins are powerful:

org admins inherit the admin role on every project in this org, immediately

That inheritance is resolved live on every request — no rows are written, and demoting an org admin takes effect on their very next API call.

The IAM & members page

Project → IAM & members is the access control page for one project. Anyone who can see the project can read it; changing anything requires admin authority over the project object.

The members table shows people and service accounts together, with their role, an "external" badge for users who joined by invitation and have no home org, and — rendered loudest of all — any active break-glass grants with their reason and expiry. See break-glass and audit.

Add a member

Adding a member works only for an email that already has an account. The role is granted to that existing account:

granted to the existing account for this address; no new account was created

If no account exists, the console points you to an invitation instead. The API's exact answer:

no account exists for <email> - invite them instead (POST /v1/projects/<id>/invitations), which lets them choose their own password when they accept

Adding is idempotent and re-grants: if the person is already a member, the role in the request replaces their current one (the API answers 201 with the same "granted to the existing account for this address" note). The 409 conflict that points you at the role-change action exists for organization members, not project members.

Change or remove a member

Change a role between member and admin, or remove the member entirely. Both are guarded so a project can never be left without a working admin:

this is the project's only admin - promote someone else first

Break-glass grants, expired grants, and service accounts do not count as "an admin" for this check — the guard protects against locking out real people. The same pattern exists one level up (this is the organization's only admin - appoint another before demoting them) and at the platform level (cannot demote the last admin - promote another account first).

Invitations

An invitation is a one-time link that grants a project role — and, for someone new, creates their account with a password they choose.

1. On the IAM page, click Invite, enter the email and role.
2. The console shows the accept link exactly once. Copy it and send it to the invitee yourself — the platform does not send email.

The link is shown once

The invitation token cannot be retrieved later. If you lose it, revoke the invitation and create a new one.

If the address already has an account, no invitation is created — the role is granted directly:

an account already existed for this address, so the role was granted to it directly - no invitation was sent and no second account was created

3. The invitee opens the link. This is the console's only signed-out page: it previews the project name and role, and — if they have no account — asks them to choose a password of at least 12 characters. Accepting never changes an existing account's password.
4. They sign in with that email and see the project.

Invitations have four states: open, accepted, revoked, and expired. An admin can revoke an open invitation at any time from the IAM page. A used, revoked, or expired link shows:

this invitation has already been used, revoked, or expired

People who join by invitation and had no account before are external: they belong to no organization, only to the projects they were invited into.

Quick reference

Action	Who can do it	Guard
Create org / manage user directory	Platform admin	default org undeletable; last platform admin protected
Create project	Org admin (own org) or platform admin	Slug conflicts rejected
Rename project	Project object admin	Never changes short, namespace, or hostnames
Delete project	Project object admin	Must be empty of agents; default project undeletable
Add / change / remove member	Project object admin	Last-admin guard
Invite	Project object admin	Link shown once; existing accounts granted directly
Read the members list	Anyone who can see the project	—

Next steps

• Service accounts and API keys — grant a machine a role, the same way you grant a person one
• Security overview — the two-axis model behind these pages
• Break-glass and audit — what those loud red rows mean