Skip to main content

Inviting your team & assigning roles

By this point SSO is configured. Now bring your team in.

The role model in 30 seconds​

EnClaw has nine roles — three platform-level (operator), five tenant-level (workspace), and one neutral default. Most customers only ever assign three: org_admin, team_admin, agent_user.

RoleScopeWhat it can do
platform_adminCross-tenantOperator role — manage all tenants, LLM pool, platform settings. Platform-operator staff only.
super_adminCross-tenantLegacy VPC top role — same as platform_admin for SaaS. Operator-only.
platform_supportCross-tenantRead-only operator role for support staff. (reserved)
platform_billingCross-tenantBilling-only operator role. (reserved)
platform_observerCross-tenantAudit-only operator role. (reserved)
org_adminYour tenantTenant-wide admin — invite users, manage all teams, set integrations, configure SSO.
security_adminYour tenantRead security audit logs, manage sensitive-data policies.
compliance_officerYour tenantRead compliance reports, no write.
team_adminOne teamManage members + agents within a single team.
agent_adminYour tenantManage agents and squads, no user management.
skills_curatorYour tenantReview + approve skills submitted to the catalog.
agent_userOne team or tenant-wideDefault — use agents, chat, file space. No admin surface.

Sensible default assignments:

  • The first 1–2 people get org_admin. They invite everyone else.
  • Tech leads / managers get team_admin on their team.
  • Everyone else gets agent_user. Bump them up only when they ask.

How to invite (single user)​

  1. Sign in as org_admin or higher.
  2. Go to /users → Invite teammate (or /admin/saas/tenants/[id]/invites if you're an operator inviting into another tenant).
  3. Enter email + role + (optional) expiry days.
  4. Click Create invite. You'll see one of three outcomes:
    • Email sent (green banner) — your Teams integration delivered the invite. They get an email with the accept link.
    • No email provider configured (red banner) — invite link is shown below the banner with a Copy button. Share it manually via Slack / DM / your own email.
    • Delivery failed (red banner) — link is still shown; same manual-share workaround.

If you keep seeing "No email provider configured", finish Integrations first (specifically the Teams integration with the send_email allowed action enabled).

How to invite (in bulk)​

There's no CSV bulk import yet — known gap. For now: invite one-by-one, or have your operator use the scripts/saas-create-user.ps1 script to seed accounts directly into the DB (requires platform_admin access on the operator side).

If you have 50+ users, talk to your operator about whether SSO group-sync covers your use case — group-sync auto-provisions users on their first SSO sign-in without needing an explicit invite per person.

Accept flow — what your invitees see​

  • Tenant has SSO configured (recommended): they click the link, see "Sign in with [your provider]", complete SSO, land in the workspace. No password to set.
  • Tenant doesn't have SSO: they click the link, set a name + password, land in the workspace.

The invite link expires after 7 days by default (configurable per-invite). Reissue from the same dialog if needed.

Existing users joining a new workspace​

If someone already has an EnClaw account on a different tenant and you invite them by email:

  • They're attached to your tenant on accept (existing-user branch — no new account created).
  • One person can currently belong to exactly one tenant in the database. If they're already in another tenant, the accept will fail with a clear "already a member elsewhere" message. They'd need to use a different email, or you'd need to sort out cross-tenant access with EnClaw support.

Teams & permissions​

Once users exist, you assemble them into teams under /users → Teams (or the dedicated /teams route). Teams are scoping units for:

  • Agents (a team owns a set of agents).
  • File Space (folders can be scoped to a team).
  • Skills (private skills are tenant-scoped; team-scoped permissions on top).

A user can belong to multiple teams. Their effective permissions are the union of their role + team memberships. See docs/permissions/rules-and-inheritance.md (in the repository) for the full model — it's more than this page needs to cover.

Next​