# Team

The **Team** section manages the users that have access to the tenant admin panel. It handles invitations, role assignment, and access revocation.

## Member list [#member-list]

The member registry shows:

- **Email** — the user's email address.
- **Role** — the assigned role, which determines the available sections and actions.
- **Added on** — the date the user was added to the tenant team.

## Roles and permissions [#roles-and-permissions]

Roles determine which sections and operations a team member can use. Sample roles:

- **Administrator** — full access to every section, including team management, API keys, and tenant settings.
- **Operator** — access to sessions and the manual review queue.
- **Observer** — read-only access (cannot perform actions).

The exact list of roles and their permissions depends on your tenant configuration.

### Per-user permissions [#per-user-permissions]

In addition to the role, you can override a granular set of permissions for a single member through `PUT /v1/team/{user_id}/permissions`. Each permission (for example, `reviews.read`, `sessions.export`, `storage.config_read`, `storage.config_write`, etc.) can be force-enabled or force-disabled for a specific user, regardless of their role. Use this when the standard role permissions do not cover a specific scenario (for example, an operator who additionally needs the right to export sessions).

## Inviting a member [#inviting-a-member]

To add a new member to the team:

1. Click **"Invite"**.
2. Enter the invitee's email address.
3. Pick the role to assign to the user.
4. Confirm the invitation.

An email with a sign-in or sign-up link is sent to the supplied address.

### Managing invitations [#managing-invitations]

The **"Invitations"** sub-section lists pending invitations. Available actions:

- **Resend** — if the email did not reach the recipient, the invitation can be sent again.
- **Revoke invitation** — removes the invitation from the pending list. After revocation, the link in the email becomes invalid.

## Changing a member's role [#changing-a-members-role]

To change an existing member's role:

1. Find the user in the list.
2. Pick the new role from the drop-down (for example, promote to administrator or restrict to operator).
3. Save changes.

The new permissions take effect after saving. The user's current admin-panel session is refreshed on the next sign-in.

## Removing a member [#removing-a-member]

To revoke a user's access to the admin panel:

1. Find the user in the list.
2. Click **"Remove"**.
3. Confirm the action.

After removal, the user can no longer sign in to this tenant's admin panel. Every action the user previously took remains in the [audit log](/en/admin/audit).

## Resetting a member's password [#resetting-a-members-password]

An administrator can reset another team member's password through `POST /v1/users/{user_id}/reset-password` (for example, after account compromise or loss of access). After the action, the member receives an email with a link to set a new password. The action is recorded in the audit log as `user.password_reset`.

> Team management and role changes are available only to users with the administrator role.