Invite teammates & roles
Add teammates to your organization, assign Admin or Member roles, and understand what each role can do.
This guide: invite teammates into your organization, give them the right role, and manage the membership list. Multi-seat membership is part of the Team plan — Free and Pro are single-operator. See Plans & billing for what each plan unlocks.
Prerequisites
- A Team subscription (or an active temporary full-plan grant for Team). The Team plan covers up to 10 team members.
- An Admin (or Owner) role in the organization. Only admins can invite, remove, or change roles.
Roles
Walwarden uses two roles you can assign, plus the Owner that the account creator holds:
| Role | Can manage members, billing, API tokens, grants | Can connect databases, run backups, restore, read evidence |
|---|---|---|
| Admin (or Owner) | Yes | Yes |
| Member | No — these surfaces are read-only or hidden | Yes |
A Member sees the same operational dashboard — databases, backups, restores, evidence — but the administrative actions (inviting teammates, changing roles, editing billing, issuing API tokens, creating grants) are hidden. The organization must always keep at least one Admin: walwarden refuses to remove or demote the last remaining admin.
Step 1: Open the Members page
In the dashboard, go to Members (/o/<your-org>/members). The table lists every active and pending teammate with their Email, Role, Joined time, and Last active time.
If you do not see the invite controls, you are signed in as a Member, not an Admin.
Step 2: Invite a teammate
- Click Invite teammate.
- Enter the teammate's email address.
- Choose a role — Member (default) or Admin.
- Send the invite.
The teammate receives an invitation email and appears in the table as a pending row until they accept. Inviting someone who already has a membership in the organization is rejected as a duplicate. Every invite is recorded in the audit chain as a member.invited event.
If the invite button is disabled
A disabled invite button with a tooltip means managed invitations are not activated for this deployment. The role model and the rest of this guide still apply; contact support to enable email invitations.
Step 3: Manage roles and removals
From the same table, an Admin can:
- Change a role — promote a Member to Admin or demote an Admin to Member. Walwarden refuses to demote the last admin. Recorded as
member.role_changed. - Remove a member — revoke an active teammate's access. Walwarden refuses to remove the last admin. Recorded as
member.removed. - Revoke a pending invite — withdraw an invitation before it is accepted. Recorded as
member.invite_revoked.
Verify it worked
The Members table shows the new teammate (pending, then active once they accept) with the role you assigned. Every membership change is in the audit chain, so you can prove who was granted or removed access and when — the same evidence trail auditors expect for access control.
Related
- Plans & billing — what Team unlocks over Pro
- Share a temporary full-plan grant — give someone time-boxed full-plan access without a subscription
- Issue a dashboard API token — mint scoped tokens for automation (Admin-only)