> ## Documentation Index
> Fetch the complete documentation index at: https://docs.obsy.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Users & Permissions
> Manage organization members, roles, and access control.
Obsy uses role-based access control (RBAC) to manage what each member of your organization can see and do. Every member is assigned one role, and that role determines their permissions across the platform.
***
## Roles
Obsy has four built-in roles, from most access to least:
| Role | Description |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Owner** | Full access to everything — billing, org settings, member management, and all operational features. The user who created the organization is automatically the Owner. |
| **Admin** | Same as Owner except cannot delete the organization or manage billing. Admins can invite/remove members, manage teams, and configure all platform features. |
| **Member** | Operational access — can create and manage incidents, configure alerts and sampling, manage services, and update the status page. Cannot invite members or manage teams. |
| **Viewer** | Read-only access — can view all dashboards, incidents, alerts, and services but cannot make changes. |
***
## Permission matrix
Here's exactly what each role can do:
### Organization & Members
| Action | Owner | Admin | Member | Viewer |
| ----------------------------- | :---: | :---: | :----: | :----: |
| Manage org settings | ✓ | ✓ | — | — |
| Delete organization | ✓ | — | — | — |
| View billing & plan | ✓ | ✓ | ✓ | — |
| Change billing/plan | ✓ | — | — | — |
| View members | ✓ | ✓ | ✓ | ✓ |
| Invite members | ✓ | ✓ | — | — |
| Change roles / remove members | ✓ | ✓ | — | — |
### Teams
| Action | Owner | Admin | Member | Viewer |
| ----------------------- | :---: | :---: | :----: | :----: |
| View teams | ✓ | ✓ | ✓ | ✓ |
| Create teams | ✓ | ✓ | — | — |
| Edit/delete teams | ✓ | ✓ | — | — |
| Add/remove team members | ✓ | ✓ | — | — |
### Incidents & Alerts
| Action | Owner | Admin | Member | Viewer |
| ---------------------------------- | :---: | :---: | :----: | :----: |
| View incidents | ✓ | ✓ | ✓ | ✓ |
| Create/declare incidents | ✓ | ✓ | ✓ | — |
| Manage incidents (assign, resolve) | ✓ | ✓ | ✓ | — |
| View alerts | ✓ | ✓ | ✓ | ✓ |
| Create/edit alert rules | ✓ | ✓ | ✓ | — |
### Services & Clusters
| Action | Owner | Admin | Member | Viewer |
| ------------------------ | :---: | :---: | :----: | :----: |
| View services | ✓ | ✓ | ✓ | ✓ |
| Edit service config | ✓ | ✓ | ✓ | — |
| View clusters | ✓ | ✓ | ✓ | ✓ |
| Register/remove clusters | ✓ | ✓ | — | — |
### OTel, Sampling & Telemetry
| Action | Owner | Admin | Member | Viewer |
| --------------------------- | :---: | :---: | :----: | :----: |
| View collector fleet | ✓ | ✓ | ✓ | ✓ |
| Deploy/configure collectors | ✓ | ✓ | — | — |
| View sampling config | ✓ | ✓ | ✓ | ✓ |
| Edit sampling rules | ✓ | ✓ | ✓ | — |
| View telemetry reviews | ✓ | ✓ | ✓ | ✓ |
| Edit telemetry standards | ✓ | ✓ | ✓ | — |
### Status Page & Integrations
| Action | Owner | Admin | Member | Viewer |
| ------------------------------- | :---: | :---: | :----: | :----: |
| View status page config | ✓ | ✓ | ✓ | ✓ |
| Manage status page | ✓ | ✓ | ✓ | — |
| View integrations | ✓ | ✓ | ✓ | ✓ |
| Connect/disconnect integrations | ✓ | ✓ | — | — |
***
## Managing members
Member management is available from the **Teams** page in the sidebar, under the **Members** tab.
### Invite a new member
1. Go to **Teams** → **Members** tab.
2. Click **Invite Member**.
3. Enter their work email and select a role.
4. Optionally assign them to one or more teams.
5. Click **Send Invitation**.
The invitee receives an email with a link to accept. Invitations expire after 7 days.
### Change a member's role
1. Go to **Teams** → **Members** tab.
2. Find the member and click the role dropdown.
3. Select the new role.
Only Owners and Admins can change roles. You cannot change the role of the organization Owner.
### Remove a member
1. Go to **Teams** → **Members** tab.
2. Click the **⋮** menu next to the member.
3. Click **Remove from organization**.
The member immediately loses access. Their past actions (incident updates, postmortems, etc.) remain attributed to them.
### Cancel a pending invitation
Go to **Teams** → **Invitations** tab and click **Cancel** next to the pending invitation.
***
## Team-level roles
Within a team, members can be designated as a **Team Lead** or a regular **Team Member**. This is an informational label used for:
* Identifying escalation contacts
* On-call routing
* Service ownership display
Team roles do not override organization-level permissions.
***
## Best practices
**Principle of least privilege** — Start new members as Viewers and upgrade their role as they need more access. This reduces the risk of accidental changes while people are onboarding.
* **Owner**: Reserve for 1–2 people who manage billing and org-level decisions.
* **Admin**: Give to engineering managers and platform leads who need to invite people and manage infrastructure.
* **Member**: Give to individual engineers and SREs who need to respond to incidents and manage services day-to-day.
* **Viewer**: Give to stakeholders, PMs, and executives who need visibility without write access.
***
## SSO & directory sync (coming soon)
Obsy will support:
* **SAML 2.0 / OIDC** for single sign-on via Okta, Azure AD, Google Workspace, and other identity providers.
* **SCIM provisioning** for automatic user lifecycle management — users are created and deactivated in Obsy when they join or leave your IdP.
* **Domain-verified auto-join** — anyone with a verified company email can join your organization automatically.
Contact us at [support@obsy.ai](mailto:support@obsy.ai) if you need SSO for your team.