> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qumo-deploy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Organizations & Team Management

> Manage organizations, project isolation, IAM roles, and member invitations.

# Organizations & Team Management

Qumo Deploy features a hierarchical organization structure designed for companies, developer teams, and automated machine principals.

```mermaid theme={null}
graph TD
  User["Authenticated User (Google / GitHub)"]
  User --> OrganizationA["Organization A (e.g. Acme Corp)"]
  User --> OrganizationB["Organization B (e.g. Staging Labs)"]

  OrganizationA --> Project1["Project: live-stream-prod"]
  OrganizationA --> Project2["Project: test-stream-local"]

  Project1 --> Bot1["Identity: github-actions"]
  Project1 --> Key1["Signing key: backend"]
```

***

## Organization Lifecycle

### Self-Service Creation

If you sign in while you hold no role in any organization and no platform role, you get a personal organization of your own, which you own and administer. A teammate who joins through an invitation gets none: they sign in to the organization they were invited to. Nobody with a platform role gets one, and neither does the deployment's bootstrap operator. To create another organization:

1. Open the organization menu: the organization name and your email at the bottom of the left sidebar, or the organization name at the top right on pages without the sidebar. On a narrow screen, open the sidebar with the menu button at the top left; the organization menu is at its bottom.
2. Select **New organization…**.
3. Enter an organization name and select **Create organization**. The organization starts on the Free plan with a dev project.
4. You become the organization's owner and are assigned `roles/organization.admin` for it.

> [!NOTE]
>
> You can own up to 3 organizations. Your personal organization, if you got one, counts toward them; an organization you were invited to doesn't. Platform admins create organizations through the admin API instead, which has no cap: such an organization starts the same way (the Free plan and a dev project) but has no owner, and the platform admin who created it is assigned `roles/organization.admin` for it.

***

## Projects & Environment Isolation

Signing keys, identities and usage each belong to a **Project** within your organization.

* **Prod Projects**: Use Qumo's managed relay network. Available on Pay as you go and Enterprise; see [Pricing & Plans](https://docs.qumo-deploy.com/console/billing.md).
* **Dev Projects**: Connect to a relay you run yourself. `qumod network create` sets one up, signing key included, and `qumod network start` runs it (see the [CLI reference](https://docs.qumo-deploy.com/cli/commands.md#qumod-network)). Your app signs credentials the same way as on prod, with a key registered on the project. One per organization on every plan; on the Free plan, dev projects are the only kind.

### Switching Projects

Use the **project switcher** at the top of the left sidebar. The project pages (signing keys, usage, access control, activity) show the selected project.

***

## Inviting Team Members & RBAC

Organization administrators can invite colleagues to collaborate on edge streaming workloads.

### Inviting a New User

1. Navigate to **Organization Settings $\rightarrow$ Members** (`/organization/members`).
2. Click **Invite Member**.
3. Enter the invitee's email address and select a role for the organization:

| IAM Role | Identifier | Scope & Capabilities |
| :- | :- | :- |
| **Organization Admin** | `roles/organization.admin` | Full control over organization settings, billing, member invites, and all child projects. |
| **Project Admin** | `roles/project.admin` | Manage signing keys and identities, grant project roles, and rename or delete the project. |
| **Project Editor** | `roles/project.editor` | Manage signing keys and identities, and rename the project. Cannot delete the project or grant roles. |
| **Project Viewer** | `roles/project.viewer` | Read-only access to the project, its usage, keys, identities, bindings and audit log. |

4. Select **Send invite**. Qumo emails the invitation; the link is also shown so you can share it yourself. The invitation expires after 7 days.

You can only grant a role whose every permission you hold yourself.

An invitation is the only way to add someone new. A role granted directly, on **Access Control $\rightarrow$ Access Bindings** or through the API, can go only to a user who already holds a role in the organization (on the organization or any of its projects); for anyone else it is refused, and you invite them instead.

### Removing Organization Admins

An organization always keeps at least one Organization Admin. Removing the last one from **Members** is refused, and so is deleting the account of an organization's only Organization Admin: add another Organization Admin first, or delete the organization. Identities holding the role do not count, since nobody can sign in as one.

***

## Machine Identities (Identities)

Headless automation systems and CI/CD pipelines should **never** share human user accounts. Instead, provision project-scoped **Identities**:

1. Navigate to **Access Control $\rightarrow$ Identities** (`/permissions?tab=identities`).
2. Under **Create Identity**, enter a descriptive name (e.g. `github-actions-deployer`) and select **Create identity**.
3. On the **Access Bindings** tab, add a binding with principal type **Identity**, the identity's ID, and a role (e.g. `roles/project.editor`).
4. Back on **Identities**, select **Issue token** for the identity. The Identity Token (`qumo_pat_…`) is shown once.

Granting a role later revokes the identity's existing tokens when it adds a permission; see [Identities](https://docs.qumo-deploy.com/guides/scopes-permissions.md#identities).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.