> ## Documentation Index
> Fetch the complete documentation index at: https://help.nops.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Users and roles
> Invite team members, assign roles, and control who can access what with role-based permissions in nOps.
## Overview
Every person who accesses nOps has a **user** account that belongs to an organization. Users are assigned a **role** that determines what they can see and do inside the platform. Administrators and owners manage the team from **Settings > Users**.
**Settings > Users** requires admin or owner permissions to open. Members don't see this page in Settings, but they can still update their own theme and appearance from the account menu — see [Profile and preferences](#profile-and-preferences) below.
***
## User management page
**Settings > Users** has three sections for admins and owners:
### My Profile
Your own profile card — from here you can:
* **Edit Profile** — update your first and last name.
* **Edit Theme** — open the theme settings modal to fine-tune your visual preferences (see [Profile and preferences](#profile-and-preferences) below).
* **Change your avatar** — click your avatar to switch between your account photo (if you signed in with SSO or an identity provider that has one) and a set of nOps profile characters.
### Organization Users
Admins and owners see the organization user list: active members, pending invitations, and each person's role. From here they can invite users, change roles, and remove members.
### Organization Roles
Admins and owners see a table of every role in the organization — built-in and custom. They can create new roles, edit custom role permissions, or delete custom roles from this section.
Roles can also be scoped to restrict *which* rows of cost data their holders see, not just which features they can access. See [Roles and data scopes](/platform/roles-and-data-scopes).
***
## Built-in roles
nOps ships with three built-in roles. These cannot be edited or deleted.
| Role | Slug | Description |
| ---------- | -------- | ----------------------------------------------------------------------------------------------------------------------- |
| **Member** | `member` | Standard access. Can view cost data, create private canvases, use Clara AI, and view shared canvases. |
| **Admin** | `admin` | Everything a member can do, plus manage users, roles, integrations, security settings, audit logs, and billing. |
| **Owner** | `owner` | Full access. Everything an admin can do, plus delete the organization, change the subscription, and transfer ownership. |
The first user in a new organization is automatically assigned the **Admin** role. At least one admin or owner must exist at all times — you cannot demote the last one.
***
## Custom roles
Admins can create custom roles from **Settings > Users > Roles** to tailor permissions for specific teams or workflows.
### Creating a custom role
Navigate to **Settings > Users** and scroll to the **Organization Roles** section.
Click **Create Role** to open the role creation dialog.
Provide a **name**, **slug** (auto-generated from the name, lowercase with hyphens), and optional **description**.
Check the permissions you want this role to have. Permissions are organized by category (see the [Permissions reference](#permissions-reference) below).
Click **Save** to create the role. It is immediately available for assignment.
### Editing a custom role
Select a custom role from the roles table and click **Edit**. You can update the name, description, and permissions. The slug cannot be changed after creation.
### Deleting a custom role
Click **Delete** on a custom role. Any users currently assigned to the deleted role are automatically reassigned to the default **Member** role.
Built-in roles (Member, Admin, Owner) cannot be edited or deleted.
***
## Permissions reference
Permissions are the building blocks behind roles. When creating or editing a custom role, you assign permissions by category. The tables below list every available permission.
### Custom role permissions
The permissions available when creating or editing a role come directly from your account's environment, so the exact list can vary. The permissions nOps ships by default include:
| Category | Permission | Slug | Description |
| ----------- | -------------------------- | ------------------------------------ | -------------------------------------------------------------- |
| **nOps** | Member | `nops:member` | Basic member access to the platform |
| **nOps** | Administrator | `nops:administrator` | Full organization management access |
| **nOps** | Super Administrator | `nops:super-administrator` | Highest privilege level, reserved for accounts nOps designates |
| **Widgets** | Manage Users Table | `widgets:users-table:manage` | Manage users via the embedded user management widget |
| **Widgets** | Manage Domain Verification | `widgets:domain-verification:manage` | Configure and verify organization domains |
| **Widgets** | Manage SSO | `widgets:sso:manage` | Configure Single Sign-On connections |
| **Widgets** | Manage API Keys | `widgets:api-keys:manage` | Create, view, and revoke API keys |
### Platform permission levels
nOps also uses broader platform-level permissions to gate features. These are assigned to users based on their role and determine access to major areas of the platform:
| Permission | Description | Granted to |
| -------------------------- | ------------------------------------------------------------------- | ------------------------------------------------------------------------------- |
| `nops:member` | Core platform access — canvases, cost data, Clara AI | All members, admins, and owners |
| `nops:administrator` | Organization management — settings, users, roles, integrations | Admins and owners |
| `nops:super-administrator` | Full platform access — global templates and presets, internal tools | Specific accounts designated by nOps (not automatically granted to every Owner) |
Admin-level permissions (`nops:administrator`) implicitly include all member permissions. You do not need to assign both.
### Feature access summary
The table below shows which roles have access to key platform features by default:
| Feature | Member | Admin | Owner |
| --------------------------------------------- | ------ | ----- | ----- |
| View home and dashboard | Yes | Yes | Yes |
| Use Clara AI chat | Yes | Yes | Yes |
| Create private canvases | Yes | Yes | Yes |
| Create shared canvases | Yes | Yes | Yes |
| View and edit shared canvases | Yes | Yes | Yes |
| Delete shared canvases | — | Yes | Yes |
| Create private data source presets | Yes | Yes | Yes |
| Create shared data source presets | Yes | Yes | Yes |
| Create private templates | Yes | Yes | Yes |
| Create shared templates | — | Yes | Yes |
| Manage users and roles | — | Yes | Yes |
| Configure SSO, SCIM, and security | — | Yes | Yes |
| View and export audit logs | — | Yes | Yes |
| Manage billing and subscription | — | — | Yes |
| Delete organization | — | — | Yes |
| View commitment recommendations and purchases | Yes | Yes | Yes |
| View Commitment Inventory | Yes | Yes | Yes |
Creating **global** templates and presets, and the internal Nexus commitment management tool, are not tied to the Owner role — they require a special designation nOps grants to specific accounts.
***
## Inviting users
Go to **Settings > Users**.
Click the **Invite** button to open the invitation dialog.
Type one or more email addresses. Each address receives a separate invitation.
Click **Send**. Each user receives an email with a link to join your organization. Invitations appear in the **Pending** list until accepted.
You can revoke any pending invitation before it is accepted. Revoked invitations are immediately invalidated and the recipient can no longer use the link to join.
Only work email addresses are accepted. Public email domains (gmail.com, yahoo.com, etc.) are blocked during sign-up.
***
## Changing a user's role
Admins can change any user's role from the organization user list:
1. Navigate to **Settings > Users**.
2. Find the user in the list.
3. Select a new role from the dropdown.
The change takes effect immediately. You cannot demote yourself if you are the last admin or owner — at least one must remain at all times.
***
## Removing a user
Admins can remove users from the organization:
1. Navigate to **Settings > Users**.
2. Find the user in the list and click **Remove** (or the delete action).
You cannot remove yourself, and you cannot remove the last admin or owner in the organization.
***
## Profile and preferences
Each user can customize their own profile and visual preferences. Admins cannot edit another user's profile — only roles and membership.
### Name
Update your first and last name from **Settings > Users > My Profile > Edit Profile**.
### Avatar
Click your avatar on **My Profile** to open the picker. Choose your account photo (if your identity provider supplied one) or pick one of nOps' profile character illustrations.
### Theme
Everyone — members, admins, and owners — can change their theme from the **account menu** (click your avatar at the bottom of the sidebar) → **Theme**. From there you can:
* Switch **Appearance** between Auto, Light, and Dark.
* Pick a **color preset**, or click **Shuffle** for a random one.
* Click **Customize theme…** to open the full theme settings modal with fine-grained sliders.
Admins and owners can also reach the same modal via **Edit Theme** on **Settings > Users > My Profile**.
**Fine-grained sliders** (in the customize modal):
| Setting | Range | Default |
| -------------- | ----- | ------- |
| **Hue** | 0–360 | 237 |
| **Saturation** | 0–100 | 87 |
| **Brightness** | 0–100 | 55 |
**Color presets** (available from either the account menu or the customize modal):
| Preset | Hue | Saturation | Brightness |
| -------- | --- | ---------- | ---------- |
| Midnight | 0 | 0 | 42 |
| Slate | 0 | 44 | 55 |
| Dusk | 215 | 100 | 48 |
| Daylight | 215 | 55 | 82 |
| Ocean | 210 | 100 | 46 |
| Lagoon | 185 | 75 | 52 |
| Violet | 245 | 70 | 61 |
| Emerald | 178 | 65 | 45 |
| Sunset | 35 | 98 | 69 |
| Coral | 358 | 93 | 66 |
### Clara chat panel
The Clara overlay panel on Canvas is resizable — drag the **left edge** to adjust its width, or the **top/bottom edges** to adjust its height. Your preferred width is saved automatically and reused the next time you open Clara. There's no separate settings form for this; just drag the panel to the size you want.
### Series limit
Control the maximum number of data series rendered in canvas charts. Adjustable from **50 to 1,000** (rounded to the nearest 50). The default is **250**. This can also be changed from the Command palette on any canvas.
***
Understand the sign-in methods, MFA, SSO, and data isolation features that protect your nOps account.