# Users and invitations

> Invite people to your organization, give them roles, change or remove them, and view the console as another member.

Product: AI Cost Optimizer Gateway (ACOG). Web version: https://tessarac.com/docs/acog/administer/users-and-invitations. Last updated: 2026-10-16.

Membership is invite-only. Open **Admin → Users** to manage members, invitations and roles. You need the **Invite, remove, and manage team members and roles** permission (`admin:users`).

## Adding people

### Hosted service: invitations

Choose **Invite a member**, enter the email address and choose a role. The person receives an email invitation, chooses how to sign in, and joins with the role you picked. There is no temporary password to pass on.

Pending invitations are listed under **Invitations**, where you can revoke one; the link then stops working immediately.

People who sign in through your [single sign-on](https://tessarac.com/docs/acog/administer/single-sign-on.md) are added automatically on their first sign-in, with a role mapped from their identity provider's groups.

### Self-hosted: add a member

Choose **Add member**, enter the email address and choose a role. ACOG shows a one-time initial password, **once**; give it to the person securely. They must choose their own password at first sign-in.

## Roles

| Role | Can |
|---|---|
| **Admin** | Everything |
| **Auditor** | View dashboards, reports, billing and the audit log. Cannot call the gateway or change anything. |
| **Member** | Call the gateway with their own keys and view dashboards |

You can also create custom roles from any combination of permissions. See [Roles and permissions](https://tessarac.com/docs/acog/reference/roles-and-permissions.md).

You can only give a role whose permissions you hold yourself. A refused change says which permission you lack.

## Changing someone's role

Choose the role in the member's row and confirm. If you change your own role to one that cannot manage users, you lose access to this page as soon as you save.

The organization always keeps at least one admin: the only admin's role cannot be changed and they cannot be removed until someone else is an admin.

## Removing someone

**Remove** ends the person's access to the organization immediately. Their user keys are disabled, and team-scoped keys are unbound. Their past usage stays in reports.

## Viewing the console as another member

An admin signed in to the console can impersonate another member to see the console exactly as they do, for example to check what their role allows. The admin's own session is paused until they choose **Exit impersonation**. The start and end are recorded in the [audit log](https://tessarac.com/docs/acog/govern/activity-and-audit-log.md) with both identities. Impersonation is not available to API keys.