# Projects & members

An organization holds your team and your projects. A project holds the agents, credentials, and data for one product.

An **organization** is your account; a **project** groups the runtimes,
bindings, conversations, and files of one product. Use one project per product,
not per customer: see [Serve many customers](/patterns/multi-tenant).

```bash
introspection members create --email dana@acme.example --name "Dana Example" --role admin
```

## Invite a teammate

1. Run `introspection members create` with an email, full name, and role, or use **Organization settings**, **Members**.
2. Verify with `introspection members list`.

Membership is organization-wide: a teammate reaches every project. You cannot
invite someone to one project only.

| Role | Can |
| --- | --- |
| `owner` | Everything, including assigning `owner` and closing the organization |
| `admin` | Manage members (tags too), projects, API credentials, applications, integrations |
| `member` | Work in every project |

What each role sees is in [Who can see what](/identity#who-can-see-what). The
CLI acts with your role. Integrations, plan, and billing are dashboard-only.

## Change a role or remove a teammate

```bash
introspection members update <member-id> --role member
```

To remove access, disable the member in **Organization settings**, **Members**.
Disabling keeps their name on earlier work, and you can enable them again. An
owner or admin can also delete a member with `DELETE /v1/members/{id}` (no CLI; [what it removes](/patterns/memory-and-data#what-each-delete-does)).

## Sign in with your company SSO

Workforce SSO is not self-serve. Contact Introspection to set up a sign-in
organization with your claimed email domain; teammates on that domain then land
in your organization. SAML is not supported.

Roles are per organization, not per project. To narrow what a teammate sees,
use [member tags and shares](/identity/sharing).

## Stay within member limits

One member limit, set by your plan, covers teammates, agents, and end users
([Limits](/reference/limits#organization-and-identity)). Each `user_id`, each
`anonymous_id`, and each Slack channel or DM counts as one member. At the limit,
a new end user is refused with `409`; existing end users keep working.
Anonymous members are not removed automatically, so prefer a stable `user_id`
and delete members you no longer need.

## Choose the project a command acts on

The CLI picks the project in this order: `--project`, then
`INTROSPECTION_PROJECT`, then your login's default project. `api-keys`,
`bindings`, and most `connectors` commands always use the login's project;
Data Plane commands use their token's project.

## Next

- [How agents act](/identity/agents)
- [Sharing & tags](/identity/sharing)
- [CLI reference](/reference/cli)

Projects & members

An organization holds your team and your projects. A project holds the agents, credentials, and data for one product.

An organization is your account; a project groups the runtimes, bindings, conversations, and files of one product. Use one project per product, not per customer: see Serve many customers.


introspection members create --email dana@acme.example --name "Dana Example" --role admin

Invite a teammate

Run introspection members create with an email, full name, and role, or use Organization settings, Members.
Verify with introspection members list.

Membership is organization-wide: a teammate reaches every project. You cannot invite someone to one project only.

Role	Can
`owner`	Everything, including assigning `owner` and closing the organization
`admin`	Manage members (tags too), projects, API credentials, applications, integrations
`member`	Work in every project

What each role sees is in Who can see what. The CLI acts with your role. Integrations, plan, and billing are dashboard-only.

Change a role or remove a teammate


introspection members update <member-id> --role member

To remove access, disable the member in Organization settings, Members. Disabling keeps their name on earlier work, and you can enable them again. An owner or admin can also delete a member with DELETE /v1/members/{id} (no CLI; what it removes).

Workforce SSO is not self-serve. Contact Introspection to set up a sign-in organization with your claimed email domain; teammates on that domain then land in your organization. SAML is not supported.

Roles are per organization, not per project. To narrow what a teammate sees, use member tags and shares.

Stay within member limits

One member limit, set by your plan, covers teammates, agents, and end users (Limits). Each user_id, each anonymous_id, and each Slack channel or DM counts as one member. At the limit, a new end user is refused with 409; existing end users keep working. Anonymous members are not removed automatically, so prefer a stable user_id and delete members you no longer need.

Choose the project a command acts on

The CLI picks the project in this order: --project, then INTROSPECTION_PROJECT, then your login’s default project. api-keys, bindings, and most connectors commands always use the login’s project; Data Plane commands use their token’s project.