Members and roles
Organization roles control broad capabilities. Domain permissions separately control which parts of the context an editor may change.
Admins manage members under Settings → Users.
Choose a role
| Role | Access |
|---|---|
| Explorer | Ask questions and read the context |
| Editor | Explorer access, plus context changes, evals, and issue triage |
| Admin | Editor access, plus projects, members, roles, and integrations |
Invite or change a member
- Invite
- Choose Invite User, then enter the email address and role. The link lasts seven days. Resending an invite, allowed once an hour, gives its link another seven days, even after it expired. Once an invite has expired, you can also invite the same address again. Email addresses are matched without regard to case.
- Sign in
- The teammate can set a password (at least 8 characters and at most 72 bytes, so fewer characters with accents or emoji) or use Google. Accepting the invite confirms the email address, so there is no separate confirmation email. Google sign-in needs an address Google reports as verified. An address already attached to another organization cannot be moved through an invite.
- Approve
- When Cassis has claimed your company’s email domain, colleagues who sign up with it wait as pending, and every admin gets an email. Choose Approve and pick their role (Explorer by default), or Reject. Ask Cassis to claim a domain; admins cannot claim one themselves.
- Suspend
- Stops sign-in while preserving the account and history. Reactivate from the same page.
- Change role
- Takes effect immediately.
Admins can read every conversation on a project, including those from MCP clients, under Settings → Conversations.
Use Domain permissions for narrower edit rights and API keys for automation.