Teams and roles
Forginate separates who is in your organization from who can touch which project. This two-ladder model lets one org host work for multiple clients or teams without everyone seeing everything.
The two ladders
- Organization membership — being in the org. Members can create projects billed to the org's plan and see org-level surfaces appropriate to their role.
- Project access — being on a specific project's team. Org membership grants no access to existing projects; each project's team is managed separately.
Why the separation exists
Adding someone to the org means "they may create projects billed to this org's plan" — nothing more. Existing projects stay invisible to them until explicitly shared. This is what makes it safe to have contractors, clients, and internal staff in the same organization.
Organization roles
Managed by owners and admins from org settings:
| Role | What it means |
|---|---|
| Owner | Full control, including billing checkout and transferring ownership. One per org. |
| Admin | Manages members, providers, deploy targets, and org settings. |
| Member | Can create projects and work within projects they're given access to. |
| Viewer | Read-only at the org level. |
Org member management supports:
- Invite by email — with a role of admin, member, or viewer. Pending invites are listed alongside the roster and can be revoked before acceptance.
- Change role and remove member.
- Transfer ownership — owner-only, hands the org to another member.
Owners and admins can also read the org's audit log, which records administrative actions like member changes and provider changes.
Project roles
Each project has its own team, managed from the project's Team dialog by that project's admins:
| Role | Label in the UI | What it can do |
|---|---|---|
| Viewer | View only | See documents, requests, and activity. Cannot change anything. |
| Editor | Power user | Edit documents, chat with the vibe editor, approve versions, and run workflow stages. |
| Admin | Admin | Everything a power user can do, plus managing this team. |
To add someone, enter their email and pick a role. If they aren't a Forginate user yet, an invite is created that grants them access when they join. Roles can be changed and members removed at any time; pending invites can be revoked.
Org owners and admins have oversight across the org's projects; scoped members see only the projects they've been added to.
What requires which access — quick reference
| Action | Requires |
|---|---|
| Read documents, requests, activity | Project viewer |
| Edit documents / vibe editor / approve versions | Project editor+ |
| Advance pipeline phases, start runs | Project editor+ |
| File / approve / reject improvement cards | Project editor+ |
| Manage the project team | Project admin |
| Manage org members and invites | Org admin+ |
| Manage model providers | Org admin+ (any member can view) |
| Manage deploy targets and deployments | Org admin+ (any member can view) |
| Read the org audit log | Org admin+ |
| Billing checkout / plan changes | Org owner |
| Transfer org ownership | Org owner |
External reviewers
People who only need to read and comment on documents don't need a role at all — use a share link instead. Shares are read-only, revocable, and don't require a Forginate account.
Personal access tokens
For API and automation use, each user can create personal access tokens under their account settings. A token's secret is shown once at creation; tokens carry scopes (for example read vs. admin) and can be revoked at any time. A token never grants more than the user's own roles allow.