Administration
Members
Manage your Teaflask team under Settings > Members. Each membership belongs to one organization; the same sign-in account can hold different roles in different organizations.
These roles govern your team's access to Teaflask. To control who can talk to an installed assistant, see User access.
Compare roles
Teaflask has two roles: member and owner. Members do everyday drafting and review work. Owners can additionally publish, administer, and spend.
| Task | Member | Owner |
|---|---|---|
| Read the workspace and talk to Brew | Yes | Yes |
| Draft docs, agents, and skills | Yes | Yes |
| Start verification and clear drift proposals | Yes | Yes |
| Read conversations, and read or delete memories | Yes | Yes |
| View the actions catalog and sitemap | Yes | Yes |
| Release docs or publish agents and skills | No | Yes |
| Decide action or sitemap proposals and set action policies | No | Yes |
| Connect repositories and set production branches | No | Yes |
| Manage keys and rotate the identity secret | No | Yes |
| View billing, add funds, change the plan, and add provider keys | No | Yes |
| Invite teammates, decide requests to join, and change or remove members | No | Yes |
| Verify domains and configure SAML | No | Yes |
| Rename the organization, change its logo, or delete it | No | Yes |
Invite a teammate
- Open Settings > Members and select Invite member.
- Enter the recipient's email address.
- Choose Member or Owner, then send the invitation.
The recipient must sign in with the invited email address. The invitation link is emailed to them and shown to you once after sending. Copy it then if you want to share it directly. It remains valid for 14 days.
The role you pick here is only a starting point: an owner can change it after the person joins.
Manage pending invitations
Invitations lists pending invitations with their roles and expiry dates. Revoking one invalidates its link immediately. Revoking an invitation is not a way to remove someone who has already joined.
Only one pending invitation per email address can exist in an organization. There is no resend action. If neither you nor the recipient can recover the link, revoke the pending invitation and send a replacement.
Change a role or remove a member
Owners see a Manage action on every other person's row under People.
- Role switches the person between Member and Owner. Each choice asks for confirmation first. Changing a role leaves the AI tools they connected in place; owner-only tools answer only while they are an owner.
- Remove from organization takes them out of the organization right away, and revokes the AI-tool connections they made here in the same step. Should they rejoin, they connect again.
Two limits apply:
- Your own row carries no controls — you cannot change your own role or remove yourself.
- An organization must keep at least one owner. Demoting or removing the last owner is refused; make someone else an owner first.
Review requests to join
When someone signs in with a work-email domain associated with your organization, Teaflask can offer your organization and let them request membership.
Pending requests appear under Requests to join, above the member list:
- Approve adds the requester as a member.
- Decline removes the request. The person can ask again later.
An ordinary domain association helps teammates find the organization. A DNS-verified domain is exclusive across Teaflask, so new users on that domain are directed to the claiming organization rather than creating another one.
Automatic membership with SSO
With an active SAML connection, new users with verified email addresses on its DNS-verified domain join the organization automatically as members. Existing members keep their roles.
Automatic joining uses the email domain, not the sign-in method. Use Require SSO if those users must authenticate through your identity provider. See SSO for setup and enforcement.