Members & roles
The people in your workspace are managed under Settings → Members. Every member holds one of three roles — viewer, member, or admin — and (for non-admins) a set of organization assignments that bound what they can see. Inviting, changing roles, and removing members is admin-only.
At a glance
| Where | Settings → Members (each row’s Manage button opens a member detail drawer) |
| Key API routes | GET /members, GET /members/{id}/activity, POST /members/invite, PATCH /members/{id}, PUT /members/{id}/orgs, DELETE /members/{id}, POST /members/{id}/resend-invite, POST /members/bulk-orgs, POST /members/bulk-persona |
| Roles | viewer < member < admin (ordered — a higher role can do everything a lower one can) |
| Who manages members | Admins (an admin can be scoped to specific orgs — see Org-scoped admins) |
| Statuses | active, invited (not yet activated), disabled (suspended) |
Roles
| Role | Summary |
|---|---|
| Admin | Full control: sees every org and agent, manages members, company-wide LLM connections, the failure taxonomy, custom views, and the audit log. Can create any API key (including admin-role), and can revoke/delete any key or connection regardless of who created it. |
| Member | The working role: sends traces, creates orgs/agents/datasets/dashboards, configures judges, schedules runs, reviews and labels sessions — within the orgs and agents they belong to. Can also create API keys (up to their own role) and org/agent LLM connections, and delete/revoke the ones they created (admin-created resources stay protected). |
| Viewer | Read-only access to the orgs and agents they belong to. |
A role can be granted at org scope (it applies to every agent in the org) or agent scope; when both apply, the higher role wins.
Full permission matrix (minimum role per action)
| Action | Minimum role |
|---|---|
| Read all data (traces, sessions, clusters, scores, judges, datasets, …) | viewer |
| Send traces (ingest) | member |
| Create/edit datasets, topics, annotations, labels | member |
| Create/edit judge versions | member |
| Enable/disable judge deployments | member |
| Start scorer/enrichment runs | member |
| Cancel an in-flight run | member |
| Create/modify org- or agent-scoped LLM connections | member |
| Create an API key (mint) — up to your own role | member |
| Revoke an API key / delete a connection you created | member |
| Create agents | member |
| Create orgs | member |
| Create a custom dashboard | member |
| Share a dashboard org-wide | member |
| Review: add ground-truth labels / critiques | member |
| Delete judges/datasets/topics (destructive) | admin |
| Create an admin-role API key | admin |
| Revoke / delete an API key or connection created by someone else | admin |
| Create/modify/delete company-wide LLM connections | admin |
| Manage agent membership | admin |
| Manage org membership (invite/remove members, change roles) | admin |
| Share a dashboard company-wide | admin |
| Delete a dashboard (non-owner) | admin |
| Manage the failure taxonomy (merge/split/rename modes) | admin |
| Confirm a candidate cluster as a failure mode | admin |
| View the audit log | admin |
| Author/manage custom views (personas) | admin |
Invite a teammate
Open the invite form
In Settings → Members, click Invite member and enter their email (and optionally a display name).
Choose a role
admin, member, or viewer.
Set organization access
Pick the org assignment:
- All organizations — every existing org in the company. For an admin this makes them a company-wide admin (the default); for a member or viewer they join every org.
- Specific organizations — exactly the orgs you pick. For an admin this makes them an org-scoped admin (restricted to those orgs); for a member or viewer it bounds what they can see.
- No organizations (member/viewer only) — the zero state: they start with an empty workspace and are prompted to create their own org (becoming its admin).
If you don’t specify anything, a member or viewer defaults to the company’s primary org.
Optionally pick a default view
You can pre-assign a view (persona lens) as the member’s default. They still see the first-login picker — pre-selected on your recommendation — and can choose anything; a view is a layout default, never a permission.
Send it
Neens creates the member with status invited and a one-time activation link
(/activate?token=…, valid for 14 days). The link is emailed to them, and also shown once in
the UI as a fallback — copy it right away if your deployment has no email relay configured (in
that case the mailer logs the message instead of sending).
The invitee gets an email — subject You're invited to <your company> on Neens — with that link.
They open it, set a password, and are signed in. If the link is lost or expires, use Resend invite
on their row — it rotates the token and issues a fresh link (only possible while they’re still
invited; an activated account can’t be re-invited).
Example. To give a new analyst read-and-work access to just your Support org: click
Invite member, enter [email protected], choose the member role, pick Specific
organizations… → Support, and optionally pre-select the Support Ops
view as their default. Send it. Jordan receives the invite email,
clicks the link, sets a password, and lands in the Support org with the Support Ops layout — and
no access to your other orgs. Invite them as admin with All organizations instead and
they’d help you run the whole workspace.
Didn’t get the invite email?
The invite email can take a minute, and can land in spam or be held by a corporate mail filter. If it hasn’t arrived:
- Check spam/junk and search for the sender, then mark it as safe so the reset and activation emails that follow aren’t filtered too.
- Ask an admin to resend. In Settings → Members, an admin opens the pending member’s row and clicks Resend invite. That issues a fresh link and invalidates the previous one, so always use the most recent email.
- Copy the link directly. Immediately after an invite (or a resend), Neens shows the one-time activation link once in the UI. An admin can copy it from there and pass it to you over your normal channel — useful when email delivery is slow. The link is single-use and expires after 14 days; once it’s used or has expired, resend for a new one.
Emails are globally unique across Neens. Inviting an address that’s already registered returns a conflict — a generic one if it belongs to a different company, so membership elsewhere is never leaked. Your plan also caps the company’s member count.
Manage existing members
Click Manage on a member row to open their detail drawer. It shows the member’s role and status, when they Joined, their Last sign-in, their Default view, and an Activity timeline (see below). From the drawer, admins can:
- Role — switch between admin, member, and viewer (
PATCH /members/{id}). - Suspend access — set status to
disabled. This revokes their active sessions and blocks sign-in immediately, but keeps the account, so you can Reactivate it any time. - Organization access — replace which orgs the member belongs to (
PUT /members/{id}/orgs). For a member or viewer this scopes what they can see; for an admin it toggles between company-wide and org-scoped (see Org-scoped admins). Changing access never affects sign-in. - Resend invite — rotate the activation link for someone who hasn’t activated (only shown while they’re still invited).
- Remove member — delete the member and revoke their sessions (
DELETE /members/{id}). - Reset two-factor authentication — operators only, and only useful for someone who has lost
both their authenticator and their recovery codes. It is a destructive confirm naming the user:
it revokes their sessions, deletes their recovery codes and clears their enrollment, leaving the
account password-only until they enroll again
(
POST /admin/users/{user_id}/mfa/reset). Verify who you are talking to through some channel other than the account you are about to unlock — see Two-factor authentication.
You can also change a member’s role and their default view directly from the row without opening the drawer. A member who has explicitly chosen their own view is never silently overridden — the UI reports the skip instead.
Activity timeline
The drawer’s Activity section (GET /members/{id}/activity) is a lifecycle history for that
one member: invites, role and status changes, org reassignments, resent invites, and removal —
each with who did it and when. It’s a focused, admin-only slice of the
audit log filtered to that member.
You can’t lock yourself out. Neens refuses to demote, suspend, or remove the company’s only usable admin (an admin who is active and can sign in — an invited-but-never-activated admin doesn’t count), and you can’t remove yourself.
Org-scoped admins
By default an admin is company-wide: they see and manage every org and every member. You can instead make an admin org-scoped — restricted to specific orgs — from the drawer’s Organization access section (or at invite time): pick Specific organizations… instead of All organizations (company-wide admin).
An org-scoped admin is a full admin within their orgs only:
- They see and can manage only members who belong to one of their orgs (plus themselves).
- They can only assign members to orgs they administer.
- They can’t create a company-wide admin — only more org-scoped admins confined to their own orgs.
Company-wide admins and the operator are unaffected — they continue to see and manage the whole company. A member’s or viewer’s org list is a visibility scope only; an admin’s org list is what they can administer.
This is different from the operator control plane’s own admin scoping (which governs the Neens operator’s staff across customer companies). Everything on this page is about managing the members of your company.
Bulk assignment
Select multiple members on the Members page to act on them at once (admin-only):
- Assign orgs… — replace the org access of every selected member in one step
(
POST /members/bulk-orgs). Each member keeps their own role. Admins are skipped (they’re unrestricted, so their org scope isn’t rewritten in bulk), and any member outside your own orgs is skipped too. - Default view — set (or clear) the selected members’ default lens at once
(
POST /members/bulk-persona). This is available on every plan — assigning an existing view is member management, not view authoring. Members who chose their own view keep it — they come back as skipped — and leaving the view empty resets them to their role-based default.
See Views (personas) for what a view actually changes.
How it works
- Members live in a global directory keyed by email, so sign-in resolves a user to their company before any tenant data is touched. Org assignments are stored as membership grants in your company’s own schema and drive what non-admins can see.
- Activation and reset links are one-time tokens, stored hashed — Neens can show a link once but never recover it, which is why Resend invite rotates rather than re-displays.
- Every membership mutation (
member.invite,member.update,member.set_orgs,member.bulk_set_orgs,member.remove,member.resend_invite,member.bulk_persona) is recorded to the audit log with before/after metadata. A member’s own slice of that history powers the drawer’s Activity timeline.
Related
- Workspace, orgs & agents — what org assignment scopes.
- Views (personas) — the default views you assign at invite time.
- Account settings — what each member controls for themselves.