Roles and permissions
What admins and members can do in an organization and in a team, and how invitations work.
Alan has two roles, Admin and Member, at two levels:
- Organization role: one per person, for the whole organization (also called the workspace).
- Team role: one per team you belong to. Being an admin of one team doesn't make you an admin of another.
Organization admins manage organization membership, billing, and spending. Team admins manage membership in their own teams. Members can change team settings and configure agents and models. Connecting source control also depends on organization policy and permissions in the provider, such as GitHub.
Organization admins can act as a team admin in every team, including teams they haven't joined.
Who can do what
| Action | Org admin | Team admin | Member |
|---|---|---|---|
| Work in a team: sessions, tasks, epics, cycles, docs, skills, automations | ✅ | ✅ | ✅ |
| Change team settings: General (name, identifier, icon), Tasks, Cycles, Epics, statuses and labels | ✅ | ✅ | ✅ |
| Configure the team's cloud environment, coding agents, models, CLI credentials, and Alan Agent | ✅ | ✅ | ✅ |
| Add team-owned source control connections when allowed by organization policy | ✅ | ✅ | ✅ |
| Link repositories available to the team and turn on codebase indexing | ✅ | ✅ | ✅ |
| Manage sharing of organization-owned source control connections | ✅ | — | — |
| Manage organization model providers | ✅ | ✅ | ✅ |
| Create a team (you become its admin) | ✅ | ✅ | ✅ |
| Invite people to a team, change team roles, remove team members, revoke team invitations | ✅ | ✅ | — |
| Delete a team | ✅ | ✅ | — |
| Invite people to the organization, change organization roles, remove organization members | ✅ | — | — |
| Plan, seats, billing, and cloud credits | ✅ | — | — |
| Rename or delete the organization | ✅ | — | — |
For GitHub, connecting a GitHub organization for the first time requires its GitHub owner. An organization-wide GitHub connection also requires an Alan organization admin. See Connect GitHub for the setup steps.
Your plan can still switch a feature off for everyone, whatever their role. For example, creating teams and inviting members need the Team or Enterprise tier. See the Feature catalog and Plans and limits.
Some limits apply regardless of role:
- A team must keep at least one admin. Alan blocks demoting or removing the last one, so promote someone else first.
- You can't remove yourself from a team or from the organization; ask an admin.
- You can't delete your organization's only team.
- Individual sessions stay visible only to the person who started them. See Start a session.
The Org Dashboard, including organization-wide cloud spend, is for organization admins. Team members can view their team's cloud usage and spending; personal usage is available in account settings.
Invitations
Team admins invite people from the team's Members page; organization admins can also invite from Settings → Organisation → Members. See Members and teams.
- Add one or more email addresses and choose a role, Admin or Member.
- The invitee gets a link (
/invite/{token}). It expires after 7 days. - Opening it shows Join with the team name and an Accept invitation button. The invitee must sign in with the email address the invitation was sent to.
An invitation is pending until it's accepted, or it ends as expired or revoked. Invitations for your email address are also applied when you first sign in. See Sign in and first run.
Agents
What an agent can do in a session depends on its agent profile, available tools, and your access. For example, Review Agent and PM Agent can't edit files. Ask an agent to confirm before anything irreversible, such as a production deploy, a force push, or deleting data, and keep credentials out of task text, artifacts, and documents.