Members and roles

Every Organization has exactly one owner. Everyone else is an admin, a member, or holds a custom role. Members see only what you grant them; owners and admins see everything.

What you can do

• Invite people by email and resend or revoke an invitation.
• Change a member’s role, or remove them.
• Limit a member to certain Projects, Environments and Services.
• Group people in Teams.
• Build custom roles from the same permission table the backend checks (paid).

The built-in roles

Role	What it can do
Owner	Everything, including deleting the Organization. One per Organization; cannot be transferred.
Admin	Everything except deleting the Organization. Reaches every Project.
Member	Reads and updates the Services and Environments they are granted; deploys, cancels, backs up and restores them; adds Domains. Cannot create or delete a Project, an Environment or a Service, add Servers, or manage members.

Settings > Members has a What each role can do grid with the full list.

Invite someone

1. Open Members

   Open Settings > Members and press Invite someone.

   cloudgate.octabyte.app/settings/members

   

2. Enter their details

   Enter the Email they will sign in with, choose a Role (Member, Admin, or a custom role), and optionally a Team. Press Create invitation.

   cloudgate.octabyte.app/settings/members

   

3. Send them the link

   The dialog shows Send them this link. Copy the invitation link and pass it on. If the instance has no mail sender, nothing was emailed and sending it is your job. The link stays in Invitations if you close the dialog.

They sign in, or create an account, and accept. An invitation expires after 48 hours; Resend it or revoke it from Invitations.

Grant access to Projects, Environments and Services

A member reaches nothing until you grant it. On their row, press Manage access and tick what they may reach. A member reaches a Service through its Project and its Environment, so granting a Service grants the two above it. For example, grant storefront / staging / web to let someone work on staging without seeing production.

Admins and the owner reach everything, so grants are not checked while someone holds those roles.

Change a role or remove a member

• Change role: takes effect on their next request; they do not have to sign in again. You cannot change your own role or the owner’s.
• Remove: their account stays, their membership of this Organization goes. A session they have open stops being allowed to do anything on its next request.

Create a custom role

1. Open Roles

   Open Settings > Roles and press Create a role.

   cloudgate.octabyte.app/settings/roles

   

2. Name it and tick what it allows

   Give it a lower-case name, such as deployer, and tick the subjects and actions it allows. Every choice comes from the same permission table the backend’s guards check.

3. Assign it

   Save, then pick it in Change role on a member’s row, or when you invite someone.

What you cannot do

Related pages

• Agents: members that are not people, with their own roles and grants.
• SSO and SCIM: let your identity provider sign people in and create members.
• Audit log: see who changed what.
• Personal keys: a member’s own credential for scripts.
• Security at Cloudgate and plans and prices.

Questions

Does Cloudgate email the invitation?

Only when the instance has a mail sender configured. The console always shows the invitation link, so you can send it yourself. An invitation expires after 48 hours.

Can I transfer ownership of an Organization?

No. The owner role is nontransferable: it cannot be given to someone else or taken from the owner.

What happens to a removed member's work?

It stays where it is. Their account remains, their membership goes, and nothing they created is reassigned or deleted.

How many custom roles can I make?

Up to ten per Organization, on the Business plan on the Hosted instance or with an Enterprise license when self-hosted.