# Organization members and access

Invite people, set roles, grant tenants, transfer ownership, and read the audit trail, from the Console or from tanomis.

An organization's owners and admins manage who belongs to it and which tenants each person can
reach. Everything here is available in the Console under the organization settings and from
`tanomis org`. The server decides every call; the CLI reports refusals as given.

- Roles: **owner**, **admin**, **developer**, **viewer**.
- Owners and admins reach every tenant. Developers and viewers reach only tenants they are
  granted.
- Accepting an invitation grants the organization's default tenant automatically.
- Every change lands in the audit trail.

## Invite a member

```bash title="Terminal"
tanomis org invite dana@example.com --role developer
tanomis org invitations ls
tanomis org invitations revoke INVITATION_ID
```

The invitee accepts from the Console link in the email, or with `tanomis org accept --token`. If the
organization has a default tenant, the new member is granted it on acceptance; otherwise grant a
tenant next.

## Grant and revoke tenant access

Developers and viewers see only the tenants named in a grant:

```bash title="Terminal"
tanomis org grants ls
tanomis org grants add PRINCIPAL_ID --tenant northwind-sandbox
tanomis org grants revoke GRANT_ID
```

Capabilities on a grant come from the vocabulary `manage`, `deploy`, `run`, `view`. A grant takes
effect on the member's next request; so does a revocation.

## Change roles and ownership

```bash title="Terminal"
tanomis org members
tanomis org members set-role MEMBER_ID --role admin
tanomis org members remove MEMBER_ID --yes
tanomis org ownership transfer MEMBER_ID
```

Transferring ownership always steps the current owner down; add `--demote-self` to choose the role
you keep. `members remove` asks for `--yes` because it is not reversible from the CLI.

## Read the audit trail

```bash title="Terminal"
tanomis org audit
```

Owners and admins read it. See [Audit and evidence](/guides/audit/audit-and-evidence) for what
the trail contains and proves.

## What members can see

The reads behind these controls are owner-or-admin. A developer or viewer who opens the
organization settings sees an explanation instead of the controls, and `tanomis org` returns the
server's refusal.

## Organization and tenant lifecycle

Creating an organization, attaching or detaching a tenant, setting the default tenant, and
suspending or deleting an organization are platform operations performed with your Tanomis
administrator, not self-service. Ask for them through your support channel.

## Where to go next

- [Organizations and tenants](/concepts/organizations-and-tenants): the model behind roles,
  grants, and workspaces.
- [Authenticate and select a workspace](/getting-started/authenticate-and-select-workspace): what
  a newly granted member does first.