Settings: members, roles and security
Your own sign-in security, and for whoever manages members: who is in the organization and what each person may do.
- Your account security (password, two-factor) applies to your sign-in only.
- Members lists everyone in the organization with their role. With the manage members permission you invite a person by email with any role, system or custom, change a member's role from the list, and remove a member. Each is recorded in the audit trail.
- You can give only a role whose permissions you hold yourself, and change or remove only a member whose role you could give: an Admin cannot make an Owner or demote one. Nobody changes or removes themselves, and the only Owner stays until another member is made an Owner.
- Roles and permissions shows the four system roles and your custom roles; New custom role builds one from the permission catalogue, again only from permissions you hold.
- Authentication policy (require two-factor for everyone, reset a member's two-factor) and API tokens are here for the people allowed to change them.
- Single sign-on (Owner only) connects your own identity provider, OpenID Connect or SAML 2.0 (from its metadata), or your LDAP / Active Directory directory (ldaps:// or StartTLS, your own CA pinned if you have one): members type their work email under Single sign-on on the sign-in page, and a directory's members then enter their directory password, which the directory checks. Only members and people you have invited get in, and the session stays in your organization.
- Language model (Owner only) decides whether prompts may go to the external language model, MiniMax, hosted in Singapore. Clear the box and no prompt leaves this deployment: the Copilot says it is off, and recommendations, document extraction and workflow AI steps show their computed result or say the model is off. The change is in the audit trail.
How to use it
- Members: type the email, optionally the name, pick the role, Invite. The person gets an email to set a password and signs in with that role.
- To change a role, pick the new one in the member's row; it takes effect on their next page.
- To remove, press Remove, then Remove (name) to confirm. Their account stays for other organizations they belong to.
- Single sign-on: register the Redirect URI shown on the card at your identity provider, enter the issuer, client ID, client secret and email domains, Save. Publish each domain's TXT record and press Check: only a proven domain finds your provider from a work email (your sign-in address works before). Invite members before they sign in with it.
Terms
- Invited, no password yet
- The person has the invitation email but has not set a password. The link in it works for a limited time; remove and invite again if it has run out.
- Custom role
- A named set of permissions your organization defines, given to members like a system role.
Access is the first thing a City checks: least privilege by default, nobody able to grant more than they have, and every change on the record.