Settings → Users lists everyone with access to the organization.
Outcome
The right people can reach your organization at the right level, and people who should not can no longer sign in.
Before you start
Inviting people and changing roles is limited to owners and admins.
1. Invite someone
Invite User sends an invitation by email containing a one-click sign-in link.
Invitations expire after seven days. If one goes stale, resend it from the same page rather than issuing a second invitation.
Checkpoint: the person appears in the list, and can sign in from the emailed link.
2. Choose a role
| Role | Can do |
|---|---|
| Owner | Everything, including transferring ownership. Exactly one per organization. |
| Admin | Manage members and integrations, on top of everything a member can do. |
| Member | Use workflows, dashboards, and data. |
Invitations offer Member and Admin. Owner is not something you can invite someone into — an organization has exactly one owner from the moment it is created, and the seat moves only through Transfer ownership.
Members are not restricted users — they can build and run workflows, define data models, and create dashboards. What they cannot do is manage people, service accounts, or workspaces.
You cannot change your own role; ask another admin or the owner. The owner's role is not editable from the user editor either — moving it requires the Transfer ownership flow on the Organization page. See Organizations and trials.
Checkpoint: the person's row shows the role you intended.
3. Take access away
People are deactivated, never deleted. There is no remove button, because removing an account would orphan the history of everything that account created.
Open a person from Settings → Users, choose Edit, and use the Status section. Deactivate takes their access away immediately, and their row stays in the list marked Inactive. An owner can Reactivate them later, which restores access at whatever role they held.
Checkpoint: the row reads Inactive, and the person sees a No active workspace page if they try to sign in with no other organization.
Before you deactivate someone
Check whether a service account runs as them. A service account borrows a member's permissions, so deactivating that member changes what the credential can reach — usually by breaking it.
Settings → Service Accounts shows the run-as member on each one. Repoint any that name the person you are about to deactivate. See Service accounts.
Common problems
The invitation expired. They last seven days. Resend from Settings → Users.
I cannot change my own role. By design. Another admin or the owner has to.
Invite User is missing. Your role is Member. Ask an admin.
Someone was deactivated and now an integration is failing. A service account was running as them. Repoint it and reactivate the integration.
Seats limit reached. Your plan caps how many members the organization can have. Deactivate someone who has left, or contact support to raise it.