# Team and permissions

> Invite teammates and understand what each organization role allows.

Invite colleagues to the organization that owns the projects they need. Their role determines whether they can investigate activity, administer projects or manage organization ownership and billing. Membership and roles apply across all projects in that organization.

## Choose a role

| Action                                                        | Member | Admin | Owner |
| ------------------------------------------------------------- | ------ | ----- | ----- |
| Read project data and use Meta Agent                          | Yes    | Yes   | Yes   |
| Manage Signals; run, stop and retry simulations               | Yes    | Yes   | Yes   |
| Manage personal connections and private saved views           | Yes    | Yes   | Yes   |
| Manage project settings, integrations and shared views        | —      | Yes   | Yes   |
| Create and edit simulation definitions and schedules          | —      | Yes   | Yes   |
| Manage ingestion keys, MCP credentials and simulation secrets | —      | Yes   | Yes   |
| Create and delete projects                                    | —      | Yes   | Yes   |
| Invite and manage admins and members                          | —      | Yes   | Yes   |
| Manage owners and organization billing                        | —      | —     | Yes   |
| Delete the organization                                       | —      | —     | Yes   |

Conversation visibility and ownership apply in addition to these roles. An admin or owner does not automatically gain access to private conversations or another user’s personal connections.

## Invite a teammate

Open the account menu and choose **Organization settings → Team**. An owner or admin chooses **Invite**, enters the teammate’s email and selects an admin or member role. The recipient signs in with that verified email and accepts the invitation.

Invitations require available seats when issued and again when accepted. A pending invitation does not reserve a seat. If acceptance is refused because the organization is full, an owner can adjust the plan or release capacity, then the recipient can retry. See [Usage and billing](/docs/platform/administration/usage-and-billing.md).

To revoke an unused invitation, return to **Organization settings → Team**, open the three-dot action menu on the invitation row, and choose **Revoke invitation → Confirm**. The invitation link then stops working.

## Change membership

Open **Organization settings → Team** and use the three-dot action menu on the member’s row:

* To change a role, choose **Edit**, select the new **Role**, then choose **Save changes**.
* To remove a member, choose **Remove**, check the person named in the dialog, then choose **Confirm**. They lose access to the organization and its projects.

Before removing a member or reducing their role, check any integrations and ongoing investigations that rely on their identity. Personal tool access and shared service credentials have different lifecycles.

Only owners manage owner membership. To hand over ownership, choose **Transfer ownership** on the new owner’s member row and confirm; they become an owner and your role becomes admin. To leave the organization, choose **Remove** on your own row and confirm **Remove yourself?**. The last owner must transfer ownership first.

## Distinguish user and service access

Organization roles govern signed-in users. Ingestion keys and MCP credentials retain their own project scope and capabilities. Removing a teammate is not a substitute for revoking a service credential they previously received.

See [API keys and credentials](/docs/platform/administration/api-keys-and-credentials.md) and [Conversations and sharing](/docs/platform/meta-agent/conversations-and-sharing.md) for those access rules.