> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corepillar.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Members and invites

> How organization membership works: who is listed, how invites are created and accepted, changing roles, and removing people.

Membership is managed from **Settings → User Management**. The older **Members** page now redirects there, so links to `/<org-slug>/settings/members` still work. This page explains the rules behind adding, inviting, changing, and removing members. For a field-by-field tour of the screen, see [User Management](/agenthub/settings/user-management).

## Who is listed

User Management shows:

* Every current member of the organization, under the box for their role.
* Every **pending** invite, marked `(pending invite)`.

Expired invites are not listed. Each member's line also carries `(owner)` if they are an Owner and `(you)` for yourself.

## Adding someone

Type their email into the box for the role you want and select **Save changes**. What happens depends on the address:

```mermaid theme={null}
flowchart TD
  A[Email added to a box] --> B{Approved for platform access?}
  B -- No --> C[Needs action: approve it first]
  B -- Yes --> D{Has a CorePillar account?}
  D -- Yes --> E[Added immediately as a member]
  D -- No --> F[Invite created, link shown]
```

| Result | Message in the save summary |
| - | - |
| **Added** | "Added as `<role>`." The person already had an account, so they are a member right away. No invite is created. |
| **Invited** | "Invited as `<role>`. Invite link: `https://<site>/invite/<token>`" |
| **Needs action** | "Needs platform access first — grant it in the Platform access tab, then save again." (super admins) or "Needs platform access first — ask a super admin to approve this email." (admins) |
| **Error** | "Not a valid email address — skipped.", "Listed in more than one box — left unchanged.", "Only a super admin can add admins.", or another reason. |

<Warning>
  AgentHub does not send invite emails. Copy the invite link from the save summary and send it to the person yourself.
</Warning>

### Roles you can assign

| You are | You can assign |
| - | - |
| Super admin | Admin, Editor (AI Builders box), Viewer (Users box) |
| Admin | Editor (AI Builders box), Viewer (Users box) |

Owner cannot be assigned through an invite or User Management.

### Invite details

* **Link format:** `/invite/<token>`, where the token is 48 random hexadecimal characters. The link's host is your deployment's configured address.
* **Expiry:** 7 days from when the invite was created or last re-sent.
* **One invite per email per organization.** Inviting the same email again, or moving a pending invite to another box, replaces the old invite: it gets a new token, the new role, and a fresh 7-day expiry. The old link stops working.
* **Platform access first.** An invite to an email that cannot sign in would be a dead link, so AgentHub refuses to create one until the email is approved. See [Platform access](/agenthub/settings/platform-access).

### Accepting

The invitee opens the link, signs in with the invited email, and becomes a member with the invited role. If the link has expired or they sign in with another address, they see **Could not accept invite**. Details are in [Accepting an invite](/agenthub/onboarding#accepting-an-invite).

If your organization uses Okta, an invitee can also sign in through SSO. A pending invite makes the **Sign in with SSO** button appear for their email, and the invite's role is used unless an Okta group mapping assigns one. See [SSO with Okta](/agenthub/settings/sso-okta).

## Changing a role

Move the email from one box to another and select **Save changes**. The summary shows "Role updated" with "Now `<role>`."

* You cannot change your own role ("You can't change your own role.").
* Only a super admin can move someone into or out of **Admins** ("Only a super admin can add or change admins.").
* The organization's last Owner cannot be demoted ("This is the org's last Owner — can't be demoted.").
* Moving a pending invite to another box re-issues the invite with the new role.

## Removing someone

Delete the email from every box and select **Save changes**. AgentHub asks you to confirm: "Remove this person?" (or "Remove N people?"), "These emails are no longer in any box. Saving will remove their access to this organization (or revoke their pending invite)." Select **Remove and save**.

| Who | Result |
| - | - |
| A member | "Removed from the organization." The removal is written to the audit log. |
| A pending invite | "Pending invite revoked." The link stops working. |

You cannot remove yourself, only a super admin can remove admins or revoke admin invites, and the last Owner cannot be removed.

<Tip>
  Removing someone from the organization does not stop them signing in to CorePillar. To block sign-in as well, a super admin should deny their email under [Platform access](/agenthub/settings/platform-access). Do both when someone leaves.
</Tip>

## Members across both products

Membership belongs to the organization, and ModelHub and AgentHub share it. Anyone you add can sign in to either site. Their role decides what they can do there: Users get ModelHub only, AI Builders and Admins get both. See [Roles and permissions](/agenthub/settings/roles-and-permissions).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.