> ## Documentation Index
> Fetch the complete documentation index at: https://docs-preview.modular.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage users

> Invite team members and manage their roles in your organization

Role-based access control manages what each member of your
organization can do. Every member holds exactly one role at a time, in order
of privilege: **Owner** > **Admin** > **Developer** > **User**. Owners and
Admins can invite new members and assign roles from the [Members
page](https://console.modular.com/members) in the console.

## Invite a new member

#### Go to the Members page

Open the [Members page](https://console.modular.com/members) in the
console and click **Invite new member**.

#### Fill in the member details

In the dialog that appears, provide the following:

* **First name** and **Last name**
* **Email**: The email address the invitation will be sent to.
* **Role**: `Admin`, `Developer`, or `User`. See [Roles & permissions
  matrix](#roles--permissions-matrix) below for what each role can do. The
  Owner role isn't assigned through invitation — see [Owner](#owner).

The invited member will receive an email with instructions to join your
organization.

## Roles & permissions matrix

| Permission                                                          | Owner | Admin | Developer | User |
| ------------------------------------------------------------------- | :---: | :---: | :-------: | :--: |
| Create endpoints & deployments ‡                                    |   ❌   |   ❌   |     ❌     |   ❌  |
| Accept Terms of Service & legal agreements                          |   ✅   |   ❌   |     ❌     |   ❌  |
| Transfer Owner role to another user                                 |   ✅   |   ❌   |     ❌     |   ❌  |
| Manage billing (payment methods, credits, auto-recharge, invoices)  |   ✅   |   ✅   |     ❌     |   ❌  |
| Invite / remove members & assign roles \*                           |   ✅   |   ✅   |     ❌     |   ❌  |
| Manage all API keys, including keys owned by others                 |   ✅   |   ✅   |     ❌     |   ❌  |
| Create / manage your own API keys                                   |   ✅   |   ✅   |     ✅     |   ❌  |
| Read organization API keys                                          |   ✅   |   ✅   |     ✅     |   ✅  |
| Run inference on any resource                                       |   ✅   |   ✅   |     ✅     |   ✅  |
| View resources, usage dashboards, models, endpoints & deployments † |   ✅   |   ✅   |     ✅     |   ✅  |

\* Admins can manage members and roles for everyone in the org except the
Owner. Admins cannot remove or demote the Owner.

† The deployments view shows "Contact sales" for orgs with no active
deployments.

‡ Self-serve deployment creation isn't available yet. See [Create a
deployment](/deployments/create).

### Owner

The **Owner** (also called the Org Admin) is the highest-privilege role a
customer can hold, and every org has exactly one at all times. The first
person to sign up for an org is its default Owner.

Only the Owner can accept the Terms of Service and other legal agreements on
behalf of the org. Your org can't purchase credits or run production
inference until this is done. The Owner also has full billing access and can
transfer the Owner role to another member.

Transferring ownership is atomic: the prior Owner is demoted to Admin (or
another role you select) in the same action, so the org is never left with
zero or two Owners. The Owner also cannot remove or demote themselves without
first transferring the role to someone else, preventing the org from being
locked out or orphaned.

### Admin

Admins have full operational control short of the guardrails reserved for the
Owner: they manage billing, invite and remove members, assign roles, and
manage every API key in the org, including keys they don't own. Admins cannot
remove or demote the Owner. Assign this role to team leads who need to run the
organization day-to-day.

### Developer

Developers can run inference on any resource and create, view, and revoke only
their **own** API keys; they can't see or manage keys owned by other members.
Developers have no access to billing and can't manage members or roles. Assign
this role to engineers and ML practitioners building on the platform.

### User

Users can view all org resources and usage dashboards and run inference, but
can't create, edit, or revoke any API key (their own or anyone else's), and
have no billing access. Assign this role to consumers of your inference
endpoints who don't need broader platform access.

## Role changes and auditing

Role changes take effect promptly, including for in-flight sessions: a
member's new permissions (or restrictions) apply on their next request. Every
role change is recorded in an audit log with the actor, target member, old
role, new role, and timestamp.

Permission checks are enforced server-side on every API and console action,
not just hidden in the UI; an unauthorized action returns an HTTP 403 with a
clear reason.

## Removing a member

Removing a member revokes or reassigns their resources according to org
policy. For example, their personal API keys are deactivated. The Owner
cannot remove themselves; see [Owner](#owner) above.