Skip to main content
User management is where administrators add people to the workspace, assign organization roles, and remove access when roles change. Day-to-day pipeline permissions still layer teams, resource shares, and connection use on top of these basics.

​
Prerequisites

You need an administrator (or equivalent) role in the organization to invite users, change org-wide roles, or deactivate accounts. If options are missing, ask your identity admin.

​
Inviting users

1

Open organization users

Go to Organization → Users (or Settings → Members, depending on your layout).
2

Send invite

Enter the corporate email, choose an initial organization role, and optional team assignments.
3

SSO and domain claims

If SSO is enforced, invites may auto-join on first login when the email domain matches your allowed domains.
Guest or contractor domains sometimes require explicit approval workflows configured by your admin.

​
Role assignment

Organization roles set the ceiling for what someone can attempt in the product. Examples common across deployments:
RoleTypical use
ViewerRead pipelines, runs, and catalog entries
Member / EditorCreate and edit resources within team scope
AdminManage users, connections, security settings, and billing contacts (varies)
Prefer the lowest org role that still lets people work, then expand with teams and project-level grants.
After invite acceptance, refine access with team membership and shared items rather than promoting everyone to admin.

​
Removing users

1

Transfer ownership

Reassign owned pipelines, connections, and schedules so automation does not stall.
2

Deactivate or remove

Use Remove or Deactivate per policy. Deactivation preserves audit history; hard removal may be restricted.
3

Rotate secrets

Rotate API keys and service accounts the user created or could have copied.
Removing a user does not automatically revoke OAuth tokens in upstream SaaS systems. Revoke grants in the provider if required by security policy.

​
Multi-organization membership

Users can belong to more than one Planasonix organization (for example a parent company and a subsidiary project). Each org has:
  • Its own billing, SSO, and audit configuration
  • Isolated connections and secrets
  • Separate team namespaces
The UI lets you switch organizations from the workspace menu. Bookmarks and API tokens are per-org unless your tooling abstracts them.
The same email may map to distinct org memberships; invitations always target a specific org ID.
Create non-human users or API keys per org for CI/CD so pipelines never rely on a human’s cross-org session.

​
Detailed RBAC

For teams, custom roles, resource sharing, and connection use semantics, use the dedicated guide:

Teams and permissions

Team structure, role bundles, sharing pipelines, and auditing access.

SSO

Federated sign-in and group mapping.

API keys

Programmatic principals and rotation.