> For the complete documentation index, see [llms.txt](https://docs.maiagent.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.maiagent.ai/maiagent-user-guide/en/org/overview.md). # Organization & Member Management The three-tier structure of organizations, roles, and members, and the three things contained in a role—feature permissions, creation permissions, and resource assignments. Read this page before setti ## What Is Organization and Member Management? MaiAgent's organization and member management works like setting up a "digital office" for your company: first create an organization for your company, add departments (roles), decide what each department can use, and then add colleagues to the appropriate departments. This design is based on **RBAC** (Role-Based Access Control): permissions are assigned to roles, not directly to individuals. {% hint style="info" %} **In simple terms:** RBAC means "define a position first, then add people to it." You first define what the "Customer Service Agent" role can do. When you add members to this role, they automatically receive all permissions assigned to a customer service agent, without having to configure each member individually. {% endhint %} *** ## Three-Tier Structure: Organization → Role → Member

Three-tier structure of organizations, roles, and members — An organization contains multiple roles. When members join a role, they receive that role's permissions and resources.

Level	Company Equivalent	Description
Organization	Your company	The top-level management unit. Members, roles, AI assistants, and knowledge bases all belong to an organization. Organizations are completely isolated from one another.
Role	Department or position	A container for permissions and resources. A member can belong to multiple roles at the same time and receives the combined permissions of all those roles.
Member	Employee	A user in the organization. Members have no permissions of their own; all permissions come from the roles to which they belong.

*** ## What a Role Contains Many people think of permissions in terms of "create/read/update/delete," but the platform organizes them differently. A role contains three elements, and all three apply together:

The three elements in a role: feature permissions, creation permissions, and resource assignments — To let members create assistants, enable both "AI Assistants" under feature permissions and "Allow creating AI assistants" under creation permissions.

Layer	What It Determines	Where to Configure It
Feature permissions	Which items appear in the left sidebar. These permissions only control visibility; they do not distinguish between read, edit, and delete access.	The Role Permissions tab for the role. Selecting a parent permission automatically includes all child permissions, or you can select only specific child permissions.
Creation permissions	Whether members can create assistants, knowledge bases, databases, and conversation platforms.	The "Allow creating" checkbox at the top of each resource assignment tab.
Resource assignments	Which assistants and knowledge bases members can access. Each item has separate read, edit, and delete controls.	The role's Assign AI Assistants, Assign Knowledge Bases, and other resource tabs.

{% hint style="info" %} **In simple terms:** Feature permissions determine "which rooms you can see," creation permissions determine "whether you can build something new in a room," and resource assignments determine "which items in the room you can access and modify." All three keys are attached to roles, and people receive them by joining a role. {% endhint %} ### Resources That Can Be Assigned to Roles The tabs on the role editing page show the resources you can assign: * **AI Assistants**, **Knowledge Bases**, **Databases**, and **Conversation Platforms**: Each includes read, edit, and delete permissions * **Tools**, **Skills**, and **Agent UI Tools**: Capabilities that members of the role can attach to assistants * **MaiGPT Access**: Whether members of the role can use MaiGPT * **Credit Quota**: The usage limit for the role. See [Credit Billing](/maiagent-user-guide/en/org/credits.md) for details

Assign AI Assistants tab on the role editing page — Role editing page: the tabs at the top list assignable resources, "Allow creating" controls creation permissions, and the read/edit/delete controls in each row define resource assignments.

*** ## Core Concepts ### Three Types of Roles

Type	Who It Includes	Characteristics
Owner	The organization creator or designated administrators	Bypasses all permission checks and can view and modify every resource in the organization. An organization can have multiple owners.
Default Role	All members, who are assigned automatically	Any permission it grants is available company-wide, and any assistant assigned to it is visible to everyone. We recommend granting only minimum permissions and assigning no resources.
Custom Role	Assigned members	Created by department or position. Custom roles can be duplicated and assigned in batches.

Role permission management list — Role list: owner, default, and custom roles, each showing its permissions, members, and number of assigned resources.

### Two Types of Members

Type	Permission Scope
Owner	Everything. Owners can manage organization settings, roles, and members.
Regular Member	The permissions of the default role, plus the permissions from every role assigned to the member.

{% hint style="warning" %} **Visibility is based only on roles, not on who created a resource.** Members of every role assigned to an assistant can see it. The platform does not grant additional permissions just because "I created it." The only way to make an assistant visible solely to its creator is to create one role per person. See the [Role and Permission Planning Guide](/maiagent-user-guide/en/org/roles/role-design-guide.md) for instructions. {% endhint %} *** ## Recommended Setup Order {% hint style="success" %} 1. **Create an organization**: See [Organization Management](/maiagent-user-guide/en/org/organization.md) 2. **Connect a sign-in method**: To use company accounts, configure [Third-Party Sign-In (SSO)](/maiagent-user-guide/en/org/sso.md) first. Member email addresses must match their SSO accounts 3. **Restrict the default role**: Grant only minimum permissions and do not assign any resources 4. **Create roles**: Create roles by department or position, then select feature and creation permissions. See [Role Permission Management](/maiagent-user-guide/en/org/roles/role-permission.md) 5. **Assign resources**: Assign assistants, knowledge bases, and other resources to roles, then configure read, edit, and delete access. See [Role Resource Access Permissions](/maiagent-user-guide/en/org/roles/group-resource-access.md) 6. **Add members and assign roles**: See [Member Management](/maiagent-user-guide/en/org/member.md). Use batch import for larger teams 7. **Test with a regular member account**: Owners bypass all permission checks, so an owner account does not show the actual member experience {% endhint %} *** ## Related Pages * [Organization Management](/maiagent-user-guide/en/org/organization.md): Create, switch, and manage organizations * [Roles and Permissions](/maiagent-user-guide/en/org/roles.md): Role permission management, resource access permissions, member filters, differences between roles and contacts, and the role and permission planning guide * [Member Management](/maiagent-user-guide/en/org/member.md): Add and remove members and assign roles * [Third-Party Sign-In (SSO)](/maiagent-user-guide/en/org/sso.md) and [Identity Sync (LDAP)](/maiagent-user-guide/en/org/identity-sync.md): Sign in with company accounts and synchronize members --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.maiagent.ai/maiagent-user-guide/en/org/overview.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.