Obsy uses role-based access control (RBAC) to manage what each member of your organization can see and do. Every member is assigned one role, and that role determines their permissions across the platform.
Roles
Obsy has four built-in roles, from most access to least:
Permission matrix
Here’s exactly what each role can do:
Organization & Members
Teams
Incidents & Alerts
Services & Clusters
OTel, Sampling & Telemetry
Status Page & Integrations
Managing members
Member management is available from the Teams page in the sidebar, under the Members tab.
Invite a new member
- Go to Teams → Members tab.
- Click Invite Member.
- Enter their work email and select a role.
- Optionally assign them to one or more teams.
- Click Send Invitation.
The invitee receives an email with a link to accept. Invitations expire after 7 days.
Change a member’s role
- Go to Teams → Members tab.
- Find the member and click the role dropdown.
- Select the new role.
Only Owners and Admins can change roles. You cannot change the role of the organization Owner.
Remove a member
- Go to Teams → Members tab.
- Click the ⋮ menu next to the member.
- Click Remove from organization.
The member immediately loses access. Their past actions (incident updates, postmortems, etc.) remain attributed to them.
Cancel a pending invitation
Go to Teams → Invitations tab and click Cancel next to the pending invitation.
Team-level roles
Within a team, members can be designated as a Team Lead or a regular Team Member. This is an informational label used for:
- Identifying escalation contacts
- On-call routing
- Service ownership display
Team roles do not override organization-level permissions.
Best practices
Principle of least privilege — Start new members as Viewers and upgrade their role as they need more access. This reduces the risk of accidental changes while people are onboarding.
- Owner: Reserve for 1–2 people who manage billing and org-level decisions.
- Admin: Give to engineering managers and platform leads who need to invite people and manage infrastructure.
- Member: Give to individual engineers and SREs who need to respond to incidents and manage services day-to-day.
- Viewer: Give to stakeholders, PMs, and executives who need visibility without write access.
SSO & directory sync (coming soon)
Obsy will support:
- SAML 2.0 / OIDC for single sign-on via Okta, Azure AD, Google Workspace, and other identity providers.
- SCIM provisioning for automatic user lifecycle management — users are created and deactivated in Obsy when they join or leave your IdP.
- Domain-verified auto-join — anyone with a verified company email can join your organization automatically.
Contact us at support@obsy.ai if you need SSO for your team. 
