People & access
Adding somebody is two decisions: what role they hold in the organization, and which workspaces they can reach. Get both right at invite time and you rarely revisit it.
Invite someone
Settings → Members → Invite. Enter their email and pick a role. The invitation sits as Pending until they accept, and you can cancel it from the same page while it's waiting.
Which role:
- Member: for almost everyone. They operate the workspaces they can reach: connections, policies, grants, agents, approvals. They cannot touch billing, membership, or workspace structure.
- Admin: for people who should be able to change the plan, invite others, create workspaces, and turn remote access on. That's a genuinely wide remit; give it to people accountable for the organization, not to people who just need to get work done.
- Owner: you. Owners can delete the organization and redefine what roles mean. A second owner is a real decision, not a convenience.
Widening someone's role later takes ten seconds and no explanation. Narrowing it after they've grown used to the access is a conversation. Invite as a member unless you already know otherwise.
On a hosted gateway, pair your own approval device before members try to pair theirs. While the gateway has no trusted device, only its owner, or an owner or admin of the organization, can pair one, because that device confirms every later one. Once it is trusted, members can pair, and each member's device waits for a device already paired to confirm it. A member can remove only a device they paired themselves; an owner or admin can ask to remove anyone's, and from gateway 1.3.46 that takes effect at once for the gateway's owner and for anyone holding Remove any approval device alone (organization owners, and admins an owner has given it to in Roles & permissions), while anyone else's removal of another person's device waits for a device of someone other than them to confirm it, and lapses after 24 hours. See Enrolling an approval device.
Scope people to workspaces
Org membership is the base grant; workspace scoping optionally narrows a plain member to specific environments. It only ever removes access, never adds it; org role always wins.
The rules, in full:
| Who | Reaches |
|---|---|
| Owner or admin | Every workspace, always. They're never scoped, and can't be. |
| Member with no assignments | Every workspace. This is the default. |
| Member with assignments | Only the listed workspaces, at the level stored for each |
That second row is the one that surprises people. A new member reaches every workspace until you scope them. If your production workspace shouldn't be open to everyone you invite, assign explicitly rather than assuming.
To assign: switch to the workspace, then console sidebar → Workspace → Members, and add them. Assigning them to one workspace immediately restricts them to that one, because the moment any assignment exists the "reaches everything" default no longer applies.
Viewer vs member
Each workspace assignment carries a level:
- Member: operates the workspace, still subject to the organization's capability matrix.
- Viewer: read-only inside that workspace. They can see the dashboard, the audit log, the grants and policies as they stand, and change nothing.
Viewer is the right tool for one person who needs visibility without the ability to act: an auditor, a stakeholder, someone new. Turning capabilities off in the role matrix is the blunter instrument, because it applies to every member in the organization.
Change someone's role
Settings → Members, then change the role on their row. It takes effect on their next request; there's nothing to sign out of. Narrowing a role narrows it immediately, so if you're demoting someone as a precaution, that precaution lands right away.
Offboarding someone
When somebody leaves, do these in order. The first step is the one that actually cuts access; the rest is tidying up after it.
- Remove them from the organization (Settings → Members → remove). Their access ends at once, across every workspace. Their Permaura account survives; it isn't yours to delete. If they pay for the plan, have an owner or admin take over billing (Managing your subscription) before any seat or plan change: once they have left, the plan still bills their payment method and nobody can add seats or upgrade it.
- Revoke the agents they connected. An agent is a separate identity from the person who wired it up. Removing the human does not revoke an agent that's still running on their laptop or in a hosted client. Go to Agents in each workspace they could reach and remove anything of theirs. Removal revokes its sessions immediately and deletes grants that named only that agent.
- Rotate the credentials they could have read. If they held Export the vault, they could have read every credential in the vault: an export writes them all into one bundle that opens with a passphrase its maker chose. Owners hold that capability; admins and members hold it only if an owner switched it on (Roles & permissions). With a device paired and the approval floor not lowered, each export waits for a paired device to confirm it, and from gateway 1.3.46 one asked for through permaura.com is confirmed by a device paired to someone other than the person exporting whenever one is trusted; their own devices confirm it only when they are the only ones trusted, or when they are the gateway's owner. A confirmed export still handed its maker every credential, so check the audit log for
permaura.vault.exportevents while they had access. If one is theirs, or you cannot tell whose it is, rotate every credential in that vault. Otherwise rotate anything they set up, since they may have held the original key from the vendor's side: open the connection and replace its credential. - Revoke their approval device if they'd paired one (Workspace → Devices), which asks you to confirm it's you. As the gateway's owner, or holding Remove any approval device alone, you remove it at once. From gateway 1.3.46, an admin without that capability waits until a device paired to someone other than the admin confirms it (their phone counts), or the gateway's owner removes it, and the removal lapses after 24 hours, as described there. Read the caution below first.
- Check the audit log for the period around their departure. Not out of suspicion, but because it's the only record that will still answer the question in six months.
Device-signed actions need a paired device, and so does every approval on a gateway whose approval floor is raised (chosen at pairing, or inherited by a gateway that had a device paired before 1.3.17). Revoking the device does not lift either requirement. If the leaver's phone was your only paired approver, pair a replacement before revoking theirs, or those approvals wait behind a device nobody has. See Approvals.
On a hosted gateway, ask them to confirm it. There a second device is held until a device already paired signs off the enrollment, so the replacement you pair while their phone is still trusted waits on their phone. Either walk them through approving it before they go, or revoke their device first and accept the gap (the gateway's owner, or an admin holding Remove any approval device alone, can do that at once; from gateway 1.3.46 any other admin's removal of their device waits for their phone to confirm it): with nothing trusted, the replacement enrolls on your account alone once you confirm it's you.
Handing over an organization
There's no one-click transfer. To hand an organization to someone else: make them an owner, have them confirm they can reach billing and the role matrix, then step down or remove yourself. Do it in that order: an organization with no owner is not a state you want to discover. If you pay for the plan, the new owner takes over billing (Managing your subscription) before any seat or plan change, since once you have left, the plan still bills your payment method and nobody can add seats or upgrade it.
You'll also need to do this before you can delete your own account: deletion is blocked while you own an organization that has other members in it.
Members and workspaces are plan-limited
How many people and how many workspaces you get comes from your plan: Free is a single personal workspace, and members with role-based access arrive on Team, one for each seat you pay for. If Invite or Create workspace is offering you an upgrade rather than a form, that's the limit rather than a permission problem. See Plans.