# Members and roles

Invite people to an organisation, track pending invitations, and choose between the Owner, Admin, and Member roles.

Invite people to your organisation, and give each one the role that matches the work they do.

The **Team** section of the organisation in [SurrealDB Studio](https://app.surrealdb.com) holds membership. Each member holds exactly one role, and that role decides what the member can see and change across every instance in the organisation.

![The Team page for the Acme Corp organisation in SurrealDB Studio, showing Members and Pending tabs with one pending invitation, a member search box, an Invite member button, and a single row for Alex Doe at alex@example.com labelled OWNER and YOU.](~/assets/img/surrealdb/manage/organisation-members.webp)

The **Members** tab lists the people who accepted an invitation. The **Pending** tab lists invitations that have been sent but not yet accepted.

## Invite a member

1. Open **Team**.
2. Select **Invite member**.
3. Enter the email address of the person you invite.
4. Choose the role that person holds.
5. Send the invitation.

The invitation appears under **Pending** until the person accepts it. An invitee without an account creates one first, then joins the organisation on the role you chose. See [Accounts and sign-in](/docs/manage/organisations/sign-in.md).

Invite the address of a named person rather than a shared mailbox, above all for the Admin and Owner roles. A shared mailbox hides which person acted, and you cannot withdraw it from one reader who leaves.

`surrealctl team invite` sends an invitation. `surrealctl team list` reports current membership, which helps when you review access across several organisations. See [surrealctl organisations](/docs/manage/surrealctl/organisations.md).

## What each role can do

The person who creates an organisation is its **Owner**. An Owner invites members as **Admin** or **Member**.

| Action | Owner | Admin | Member |
| --- | --- | --- | --- |
| View instances and team | Yes | Yes | Yes |
| Deploy, pause, and delete instances | Yes | Yes | No |
| Change instance configuration and [capabilities](/docs/manage/instances/configure.md#capabilities) | Yes | Yes | No |
| Invite and remove members | Yes | Yes | Own membership only |
| Change another member's role | Yes | No | No |
| View [invoices](/docs/manage/organisations/billing.md) | Yes | Yes | No |
| Change billing and payment details | Yes | No | No |

An Admin operates the infrastructure of the organisation, but does not control its payment details or its access list. A Member reads what the organisation holds, and can end its own membership.

> [!NOTE]
> Each role is a fixed set of permissions. Custom roles and per-user granular permissions are planned.

## Least privilege

Grant the lowest role that lets a person do their work, then review the member list at regular intervals.

Three actions need particular attention, because each one causes loss or exposure that is hard to reverse:

- **Delete an instance:** destroys the data in it. See [Configure an instance](/docs/manage/instances/configure.md#delete-an-instance).
- **Change [network access](/docs/manage/instances/network-access.md):** decides which external destinations a query can reach.
- **Restore a [backup](/docs/manage/instances/backups.md):** creates a new instance that holds a copy of production data.

Every Owner and every Admin can run all three. To let someone operate instances without these permissions, use a separate organisation rather than a lower role.

Remove access when a person leaves the project. A member who has left keeps the Admin role until you remove the membership.

## Related pages

- **[Organisations](/docs/manage/organisations.md):** The organisation view and its settings.
- **[Accounts and sign-in](/docs/manage/organisations/sign-in.md):** How an invitee creates an account.
- **[surrealctl organisations](/docs/manage/surrealctl/organisations.md):** Teams, invitations, and tokens from the command line.