Skip to main content
Role-based access control manages what each member of your organization can do. Every member holds exactly one role at a time, in order of privilege: Owner > Admin > Developer > User. Owners and Admins can invite new members and assign roles from the Members page in the console.

​
Invite a new member

​
Go to the Members page

Open the Members page in the console and click Invite new member.

​
Fill in the member details

In the dialog that appears, provide the following:
  • First name and Last name
  • Email: The email address the invitation will be sent to.
  • Role: Admin, Developer, or User. See Roles & permissions matrix below for what each role can do. The Owner role isn’t assigned through invitation — see Owner.
The invited member will receive an email with instructions to join your organization.

​
Roles & permissions matrix

* Admins can manage members and roles for everyone in the org except the Owner. Admins cannot remove or demote the Owner. † The deployments view shows “Contact sales” for orgs with no active deployments. ‡ Self-serve deployment creation isn’t available yet. See Create a deployment.

​
Owner

The Owner (also called the Org Admin) is the highest-privilege role a customer can hold, and every org has exactly one at all times. The first person to sign up for an org is its default Owner. Only the Owner can accept the Terms of Service and other legal agreements on behalf of the org. Your org can’t purchase credits or run production inference until this is done. The Owner also has full billing access and can transfer the Owner role to another member. Transferring ownership is atomic: the prior Owner is demoted to Admin (or another role you select) in the same action, so the org is never left with zero or two Owners. The Owner also cannot remove or demote themselves without first transferring the role to someone else, preventing the org from being locked out or orphaned.

​
Admin

Admins have full operational control short of the guardrails reserved for the Owner: they manage billing, invite and remove members, assign roles, and manage every API key in the org, including keys they don’t own. Admins cannot remove or demote the Owner. Assign this role to team leads who need to run the organization day-to-day.

​
Developer

Developers can run inference on any resource and create, view, and revoke only their own API keys; they can’t see or manage keys owned by other members. Developers have no access to billing and can’t manage members or roles. Assign this role to engineers and ML practitioners building on the platform.

​
User

Users can view all org resources and usage dashboards and run inference, but can’t create, edit, or revoke any API key (their own or anyone else’s), and have no billing access. Assign this role to consumers of your inference endpoints who don’t need broader platform access.

​
Role changes and auditing

Role changes take effect promptly, including for in-flight sessions: a member’s new permissions (or restrictions) apply on their next request. Every role change is recorded in an audit log with the actor, target member, old role, new role, and timestamp. Permission checks are enforced server-side on every API and console action, not just hidden in the UI; an unauthorized action returns an HTTP 403 with a clear reason.

​
Removing a member

Removing a member revokes or reassigns their resources according to org policy. For example, their personal API keys are deactivated. The Owner cannot remove themselves; see Owner above.