# Invite people and set roles

> Add someone to your organization, choose what they can do, and take access away without losing the history they created.

**Settings → Users** lists everyone with access to the organization.

## Outcome

The right people can reach your organization at the right level, and people who
should not can no longer sign in.

## Before you start

Inviting people and changing roles is limited to owners and admins.

## 1. Invite someone

**Invite User** sends an invitation by email containing a one-click sign-in
link.

Invitations expire after seven days. If one goes stale, resend it from the same
page rather than issuing a second invitation.

**Checkpoint:** the person appears in the list, and can sign in from the emailed
link.

## 2. Choose a role

| Role | Can do |
|---|---|
| **Owner** | Everything, including transferring ownership. Exactly one per organization. |
| **Admin** | Manage members and integrations, on top of everything a member can do. |
| **Member** | Use workflows, dashboards, and data. |

Invitations offer Member and Admin. Owner is not something you can invite
someone into — an organization has exactly one owner from the moment it is
created, and the seat moves only through **Transfer ownership**.

Members are not restricted users — they can build and run workflows, define
data models, and create dashboards. What they cannot do is manage people,
service accounts, or workspaces.

You cannot change your own role; ask another admin or the owner. The owner's
role is not editable from the user editor either — moving it requires the
**Transfer ownership** flow on the Organization page. See [Organizations and
trials](/help/account-access/organizations-and-trials).

**Checkpoint:** the person's row shows the role you intended.

## 3. Take access away

People are deactivated, never deleted. There is no remove button, because
removing an account would orphan the history of everything that account
created.

Open a person from **Settings → Users**, choose **Edit**, and use the
**Status** section. **Deactivate** takes their access away immediately, and
their row stays in the list marked **Inactive**. An owner can **Reactivate**
them later, which restores access at whatever role they held.

**Checkpoint:** the row reads **Inactive**, and the person sees a **No active
workspace** page if they try to sign in with no other organization.

## Before you deactivate someone

Check whether a service account runs as them. A service account borrows a
member's permissions, so deactivating that member changes what the credential
can reach — usually by breaking it.

**Settings → Service Accounts** shows the run-as member on each one. Repoint
any that name the person you are about to deactivate. See [Service
accounts](/help/credentials-connections/service-accounts).

## Common problems

**The invitation expired.** They last seven days. Resend from **Settings →
Users**.

**I cannot change my own role.** By design. Another admin or the owner has to.

**Invite User is missing.** Your role is **Member**. Ask an admin.

**Someone was deactivated and now an integration is failing.** A service
account was running as them. Repoint it and reactivate the integration.

**Seats limit reached.** Your plan caps how many members the organization can
have. Deactivate someone who has left, or contact support to raise it.

## Next step

[Organize work into workspaces](/help/account-access/workspaces).