Manage your Teaflask team under **Settings > Members**. Each membership belongs to one organization; the same sign-in account can hold different roles in different organizations.

These roles govern your team's access to Teaflask. To control who can talk to an installed assistant, see [User access](/access).

## Compare roles

Teaflask has two roles: **member** and **owner**. Members do everyday drafting and review work. Owners can additionally publish, administer, and spend.

| Task                                                                     | Member | Owner |
| ------------------------------------------------------------------------ | ------ | ----- |
| Read the workspace and talk to Brew                                      | Yes    | Yes   |
| Draft docs, agents, and skills                                           | Yes    | Yes   |
| Start verification and clear drift proposals                             | Yes    | Yes   |
| Read conversations, and read or delete memories                          | Yes    | Yes   |
| View the actions catalog and sitemap                                     | Yes    | Yes   |
| Release docs or publish agents and skills                                | No     | Yes   |
| Decide action or sitemap proposals and set action policies               | No     | Yes   |
| Connect repositories and set production branches                         | No     | Yes   |
| Manage keys and rotate the identity secret                               | No     | Yes   |
| View billing, add funds, change the plan, and add provider keys          | No     | Yes   |
| Invite teammates, decide requests to join, and change or remove members  | No     | Yes   |
| Verify domains and configure SAML                                        | No     | Yes   |
| Rename the organization, change its logo, or delete it                   | No     | Yes   |

## Invite a teammate

1. Open **Settings > Members** and select **Invite member**.
2. Enter the recipient's email address.
3. Choose **Member** or **Owner**, then send the invitation.

The recipient must sign in with the invited email address. The invitation link is emailed to them and shown to you once after sending. Copy it then if you want to share it directly. It remains valid for **14 days**.

The role you pick here is only a starting point: an owner can change it after the person joins.

### Manage pending invitations

**Invitations** lists pending invitations with their roles and expiry dates. Revoking one invalidates its link immediately. Revoking an invitation is not a way to remove someone who has already joined.

Only one pending invitation per email address can exist in an organization. There is no resend action. If neither you nor the recipient can recover the link, revoke the pending invitation and send a replacement.

## Change a role or remove a member

Owners see a **Manage** action on every other person's row under **People**.

- **Role** switches the person between **Member** and **Owner**. Each choice asks for confirmation first. Changing a role leaves the AI tools they connected in place; owner-only tools answer only while they are an owner.
- **Remove from organization** takes them out of the organization right away, and revokes the AI-tool connections they made here in the same step. Should they rejoin, they connect again.

Two limits apply:

- Your own row carries no controls — you cannot change your own role or remove yourself.
- An organization must keep at least one owner. Demoting or removing the last owner is refused; make someone else an owner first.

## Review requests to join

When someone signs in with a work-email domain associated with your organization, Teaflask can offer your organization and let them request membership.

Pending requests appear under **Requests to join**, above the member list:

- **Approve** adds the requester as a member.
- **Decline** removes the request. The person can ask again later.

An ordinary domain association helps teammates find the organization. A DNS-verified domain is exclusive across Teaflask, so new users on that domain are directed to the claiming organization rather than creating another one.

## Automatic membership with SSO

With an active SAML connection, new users with verified email addresses on its DNS-verified domain join the organization automatically as members. Existing members keep their roles.

Automatic joining uses the email domain, not the sign-in method. Use **Require SSO** if those users must authenticate through your identity provider. See [SSO](/sso) for setup and enforcement.