Skip to main content
User management is where administrators add people to the workspace, assign organization roles, and remove access when roles change. Day-to-day pipeline permissions still layer teams, resource shares, and connection use on top of these basics.

​
Prerequisites

You need an administrator (or equivalent) role in the organization to invite users, change org-wide roles, or deactivate accounts. If options are missing, ask your identity admin.

​
Inviting users

1

Open organization users

Go to Organization → Users (or Settings → Members, depending on your layout).
2

Send invite

Enter the corporate email, choose an initial organization role, and optional team assignments.
3

SSO and domain claims

If SSO is enforced, invites may auto-join on first login when the email domain matches your allowed domains.
Guest or contractor domains sometimes require explicit approval workflows configured by your admin.

​
Role assignment

Organization roles set the ceiling for what someone can attempt in the product. Examples common across deployments:
Prefer the lowest org role that still lets people work, then expand with teams and project-level grants.
After invite acceptance, refine access with team membership and shared items rather than promoting everyone to admin.

​
Removing users

1

Transfer ownership

Reassign owned pipelines, connections, and schedules so automation does not stall.
2

Deactivate or remove

Use Remove or Deactivate per policy. Deactivation preserves audit history; hard removal may be restricted.
3

Rotate secrets

Rotate API keys and service accounts the user created or could have copied.
Removing a user does not automatically revoke OAuth tokens in upstream SaaS systems. Revoke grants in the provider if required by security policy.

​
Multi-organization membership

Users can belong to more than one Planasonix organization (for example a parent company and a subsidiary project). Each org has:
  • Its own billing, SSO, and audit configuration
  • Isolated connections and secrets
  • Separate team namespaces
The UI lets you switch organizations from the workspace menu. Bookmarks and API tokens are per-org unless your tooling abstracts them.
The same email may map to distinct org memberships; invitations always target a specific org ID.
Create non-human users or API keys per org for CI/CD so pipelines never rely on a human’s cross-org session.

​
Detailed RBAC

For teams, custom roles, resource sharing, and connection use semantics, use the dedicated guide:

Teams and permissions

Team structure, role bundles, sharing pipelines, and auditing access.

SSO

Federated sign-in and group mapping.

API keys

Programmatic principals and rotation.