Members and roles
The four AgentKeeper roles — owner, admin, member, developer — what each can do, how to invite people, and how roles relate to SSO.
Every person in an organization holds exactly one role. Roles control the dashboard, not what the runtime collects.
| Where | Settings → Access → Members |
| Role needed to change | Owner or Admin |
The four roles
| Role | Can do |
|---|---|
| Owner | Everything, including billing, deleting the organization, and transferring ownership |
| Admin | Manage policy, connectors, API keys, identity providers, members, and exceptions |
| Member | Read the dashboard and evidence they are allowed to see |
| Developer | Read investigations and AI Discovery. Lands on /investigations, not the overview |
Developers and Members cannot invite users, change roles, create API keys, or manage identity providers. They can still view the runtime evidence their organization exposes to them.
Invite someone
Send the invite
In Settings → Access → Members, add the email address and pick a role.
They accept
The invite link creates their account and adds the membership row.
Confirm the role
The Members table shows the active role. Change it there at any time — the new role applies on their next page load.
Roles and identity providers
SSO decides who can sign in. Roles decide what they see once they are in. A user who authenticates through SSO but has no membership row gets Member.
Directory sync is a third, separate thing: it maps workstations to people and feeds group-based policy audiences. A synced directory account is not a dashboard user until you invite them.
Audit
Role changes, API key creation, identity-provider changes, and group membership edits are recorded in Settings → Access → Audit.