User Management¶

This guide covers managing users and permissions in your AG2Trust organization.

Understanding Roles¶

AG2Trust uses role-based access control (RBAC) with four roles:

Permission Matrix¶

Inviting Users¶

Send an Invitation¶

1. Go to Users in the sidebar
2. Click Invite User
3. Enter the user's email address
4. Select a role
5. Click Send Invitation

The user receives an email with: - Invitation link - Organization name - Assigned role

Invitation States¶

Resend Invitation¶

For pending invitations:

1. Go to Users
2. Find the pending invitation
3. Click Resend

Managing Users¶

View Users¶

The Users page shows:

• Active users
• Pending invitations
• User roles
• Last active timestamp

Change User Role¶

1. Go to Users
2. Find the user
3. Click the role dropdown
4. Select new role
5. Confirm the change

Remove User¶

1. Go to Users
2. Find the user
3. Click Remove
4. Confirm removal

Removed users: - Lose access immediately - Cannot see organization resources - Can be re-invited later

Organization Ownership¶

Owner Responsibilities¶

The organization owner:

• Has full access to all features
• Manages billing and subscription
• Can delete the organization
• Cannot leave (must transfer or delete)

Transferring Ownership¶

To transfer ownership:

1. Go to Settings > Organization
2. Click Transfer Ownership
3. Select a user (must be Admin)
4. Confirm the transfer

After transfer: - New owner has full access - Previous owner becomes Admin - Cannot be undone (new owner must re-transfer)

Best Practices¶

1. Minimize Owner Count¶

Recommended:
├── 1 Owner (founder/CTO)
├── 2-3 Admins (engineering leads)
├── Team Members
└── Viewers (stakeholders)

2. Use Appropriate Roles¶

3. Regular Access Reviews¶

Monthly checklist: - [ ] Remove departed employees - [ ] Review role appropriateness - [ ] Check pending invitations - [ ] Verify no unnecessary admins

4. Document Access Decisions¶

Maintain a log of: - Who was granted access - What role and why - When access was granted - When access should be reviewed

Resource Ownership¶

Organization-Owned Resources¶

All resources belong to the organization, not individual users:

Organization: Acme Corp
├── Agents (belong to org)
├── Teams (belong to org)
├── Workflows (belong to org)
└── API Keys (belong to org)

This means:

• No "my agents" vs "your agents"
• Users don't own what they create
• Resources stay when users leave
• Permissions are binary per role

Implications¶

Audit Trail¶

All user management actions are logged:

{
  "event": "user_role_changed",
  "actor": "owner@company.com",
  "target": "developer@company.com",
  "old_role": "member",
  "new_role": "admin",
  "timestamp": "2025-01-15T10:30:00Z"
}

View audit logs in Compliance > Audit Logs.

Troubleshooting¶

User can't log in¶

1. Check invitation was accepted
2. Verify user email is correct
3. Check user wasn't removed
4. Have them reset password

User missing permissions¶

1. Check user's current role
2. Verify role has needed permission
3. Upgrade role if appropriate
4. Check for UI bugs (refresh)

Can't invite users¶

1. Verify you're Owner or Admin
2. Check invitation limit (plan-based)
3. Ensure email is valid format
4. Check for existing invitation

Enterprise Features¶

Single Sign-On (SSO)¶

Coming soon

SAML 2.0 integration for enterprise identity providers: - Okta - Azure AD - OneLogin - Google Workspace

Directory Sync¶

Coming soon

Automatic user provisioning from identity provider.

Next Steps¶

• Security Model - Full security details
• Data Retention - GDPR compliance
• API Keys - API key management