Organisations, members and roles

Last updated 7 November 2026

For owners and managers who bring a team into Spellwarden. At the end you will have created an organisation, invited people by email and given each of them a role, and you will know how to change a role, remove a member, hand over ownership and delete an organisation.

Everything in Spellwarden belongs to an organisation: its skills, MCP servers, findings, policy, API keys and billing. People belong to organisations through a role. Accounts, roles and invitations are available on the Team and the Enterprise plan, and during the free trial.

Plans: Team and Enterprise

Accounts and organisations

A person has one account, and one account can belong to many organisations. The account is who you are: your name, your email address and the ways you sign in. An organisation is a team's workspace, with its own members, policy and billing. Your role is set per organisation, so you can be an Owner of one and a Viewer of another.

Anyone can create an account, with an email address and a password or with Google, and anyone can create an organisation or accept an invitation to one. The sign-in guide covers the sign-in methods.

Switch between organisations

Each organisation has its own address, dash.spellwarden.ai/<url name>. Open the organisation switcher at the top of the dashboard to move to another organisation, find one by name, or open the list of all organisations. The Your organisations page shows every organisation you belong to with your role, its plan and its status: Trial, Active, Payment failed, Read-only, Suspended or Being deleted.

Some things belong to you and not to an organisation. Your name, your sign-in methods, your two-factor setting and the apps you connected, such as Claude, are on your account page, and a connected app reaches every organisation you belong to. An organisation that requires single sign-on or two-factor sign-in applies that requirement to its own pages only.

Create an organisation

Open Your organisations and select Create organisation.
Enter the organisation name, up to 64 characters. It is shown to members and on invitations.
Check the URL name. It is suggested from the name until you edit it, and it is 3 to 50 lower-case letters, digits and hyphens, not starting or ending with a hyphen. A few words are reserved, such as admin, billing and docs, and the dashboard says so if you pick one.
Accept the terms and conditions and the privacy policy, then select Create organisation. The new organisation opens at once and you are its Owner.

A new organisation starts a 14-day trial of the Team plan, with no card needed. If no billing is added by the end of the trial, the organisation becomes read-only until an owner or billing member adds it. Nothing is deleted. The plans and billing guide explains prices, seats and what read-only means.

Limits and what can go wrong

Creating an organisation needs a verified email address. An account that exists only through an organisation's single sign-on cannot create one: sign up with your email address or with Google instead.
You can own 3 organisations at once without billing, and you can create up to 5 a day. At the limit, add billing to one of your organisations, or delete one, to create another.
The URL name is unique. Spellwarden answers that another organisation uses the URL, or used it before: the URL of a deleted organisation is never given to another.

Invite people

Owners and managers invite people from Settings, then Members. Select Invite members, enter one email address per line and choose a role. A single request takes up to 10 email addresses. The role choices show only the roles you may give: an owner can give any role, and a manager can give Manager, Member and Viewer, not Owner and not Billing.

Each address gets an email with a link that is valid for 30 days. The dialog then lists what happened to each address: the invitation was sent, the person is already a member, the address already has an invitation (use Resend), or the invitation was saved but the email could not be sent. Spellwarden sends at most 3 invitation emails a day from one organisation to one address, and when that is used up the invitation is kept and you can resend it the next day.

What the person sees

The link opens a page that names the organisation, the person who invited them, the role and the address the invitation was sent to. They sign in or create an account, then select Accept invitation or Decline. The role the invitation carried becomes their role in the organisation.

Anyone who is signed in and holds the link can accept it, also from a different account than the address it was sent to, for example a personal Google account for a work invitation. The page shows the invited address and the signed-in address side by side, and the audit log records both. Treat an invitation link like a key: if it went to the wrong place, revoke the invitation.

Resend and revoke

The Invitations table on the Members page lists each invitation with its address, role, who invited, when it expires and whether it is pending or expired. Resend creates a new link with a new 30 days and sends it again, also for an expired invitation; an expired invitation stays listed for another 30 days so that you can do this. Revoke deletes the invitation, and its link stops working. A manager cannot resend or revoke an invitation for a role the manager cannot give, such as Owner.

Rules that can stop an invitation

During the trial, and while an organisation is read-only, it can hold at most 20 members, counting pending invitations. Paid organisations have no cap on members.
A read-only organisation can invite only people with the Billing role, so that someone can pay.
An invitation stands on the authority of the person who sent or last resent it. If that person is removed, leaves or loses the right to invite, the invitations they sent are revoked.
If the organisation requires single sign-on or two-factor sign-in, the person must sign in that way before they can accept.

Roles

Every member has one role in the organisation. Owner and Manager run the organisation, Member uses Spellwarden, Viewer reads everything and changes nothing, and Billing looks after payment only. The table lists what each role can do; it follows the permission map of the product, and the server checks it on every request.

What each role can do
What	Owner	Manager	Member	Viewer	Billing
See the organisation, its plan and its members	Yes	Yes	Yes	Yes	Yes
Read skills, MCP servers, findings, policy and evals	Yes	Yes	Yes	Yes	No
Run scans, import skills and servers, triage findings, start eval runs	Yes	Yes	Yes	No	No
Use the Claude connector	Yes	Yes	Yes	Yes (read only)	No
See the API keys	Yes	Yes	Yes	Yes	No
Create and revoke API keys and CI connections	Yes	Yes	No	No	No
Change policy, publish policy packs, edit the registry policy	Yes	Yes	No	No	No
Rename the organisation	Yes	Yes	No	No	No
Invite people and manage invitations	Yes	Yes	No	No	No
Change roles and remove members	Yes	Yes	No	No	No
Read the audit log (Enterprise)	Yes	Yes	No	No	No
Read stored runtime content, when an owner turned it on	Yes	Yes	No	No	No
Turn runtime content storage on or off	Yes	No	No	No	No
Manage billing: checkout, plan, cancel, customer portal	Yes	No	No	No	Yes
Change the URL name, require two-factor or single sign-on, set up single sign-on, delete or restore the organisation	Yes	No	No	No	No

Every member, whatever the role, can leave the organisation and manage their own account. The Billing role cannot open the scan, policy or eval pages; it is meant for a colleague who only handles payment.

Who can give and change which role

Give a role: a person can give only a role whose permissions are a subset of their own. An owner gives any role. A manager gives Manager, Member and Viewer.
Change or remove a member: a person can change or remove only a member whose role has permissions within their own. A manager can change and remove managers, members and viewers, but not owners or billing members.
Nobody changes their own role. To step down as an owner, make someone else an owner first.
Every organisation keeps at least one owner. Spellwarden refuses any change that would leave the organisation without one.

Owners, managers, members and viewers are billed seats. Billing members are free. The billing guide explains how seats change the price.

Change a role, remove a member, leave

Change a role

On Settings, then Members, select Change role in the member's row, choose the new role and select Save role. The person gets an email notice of the change. Invitations that the member sent and that the new role may not send are revoked, and the seat count follows the new role, for example when someone becomes a Billing member.

Remove a member

Select Remove in the member's row and confirm. The person loses access at once and gets an email notice. Their invitations are revoked. If the organisation uses single sign-on, single sign-on does not add the person back: to let them in again, invite them.

Leave an organisation

Any member can leave from the Members page, under Leave organisation, or from the Organisations list on their account page. Leaving also ends access at once. The last owner cannot leave: the button is disabled with the reason, and the way out is to make someone else an owner first. Someone who left is not added back by single sign-on either; an invitation brings them back.

Deleting your account is a separate step on your account page. It removes you from every organisation, and it is refused while you are the only owner of an organisation that has other members.

Transfer ownership

There is no separate transfer action. Ownership moves by roles, and an organisation can have several owners at the same time:

Make someone else an owner: change an existing member's role to Owner, or invite the person with the Owner role.
If you want to stop being an owner, ask the new owner to change your role, or leave the organisation. You cannot change your own role.

The last owner cannot step down or leave, so ownership never ends up with nobody. An owner can change or remove another owner.

Delete an organisation

Only an owner can delete an organisation, from Settings, then Organisation, under Delete organisation. Type the organisation's URL name to confirm. Deleting does three things at once: members lose access, billing stops without a refund, and the organisation shows as Being deleted.

For one day, an owner can restore the organisation, from Your organisations or from the organisation's own address. Billing is not restored: an owner or billing member adds it again, and if the trial has ended the organisation stays read-only until then.
After that, the organisation is closed for good. Spellwarden keeps its records, shows them to nobody and never gives its URL name to another organisation.

Erasing personal data about you that a deleted organisation holds is possible on request: write to hello [at] spellwarden [dot] ai. The privacy policy lists what is kept and for how long.

Rename and URL changes are separate from deletion. Any owner or manager can rename the organisation, and only an owner can change the URL name. Changing the URL breaks bookmarks and API calls that use the old one.