# Organizations and roles

An organization is the home of your people, your bots, and your settings. You create it in the [Console](/console) when you sign up. You can also join an existing organization with an invitation.

## Roles

Every person has one role.

| Role | What the person can do |
| --- | --- |
| Owner | Manages the organization. Appoints and removes Owners and Admins. |
| Admin | Manages bots, API keys, members, connectors, channels, models, and settings. |
| Builder | Builds and publishes bots, skills, triggers, and Knowledge Bases. Uses the Console assistant. Manages their own API keys. |
| Member | Uses Chat. Does not open the Console. |
| Viewer | Reads. Changes nothing. Made for the CLI and the API. |

A Member who opens the Console sees a short note with a link to the Chat address. The last Owner cannot leave or lose the role.

### Builder

A Builder builds bots. A Builder can:

- Open the Console.
- Create and change bots, skills, triggers, and Knowledge Bases, and publish bots.
- Use the [Console assistant](/console-assistant).
- Test bots and use the models.
- See the sessions they started themselves.
- Create and revoke their own API keys, with at most their own permissions.
- See their own usage.

A Builder cannot open Vaults, Members, Connections, Settings, or Billing. A Builder does not see the API keys, usage, or sessions of other people.

### Viewer

A Viewer reads what is not critical and changes nothing. The role is made for the CLI and the API, so the Console shows a Viewer little: the Knowledge Bases, their own API keys, and their own usage. Through the CLI and the API a Viewer reads bots, skills, and Knowledge Bases. A Viewer cannot run bots, create or change anything, or use Chat. A Viewer's API keys can read bots and Knowledge Bases.

## Invite people

An Owner or Admin invites people in the Console under Members, with Invite. Enter an email address and pick a role. The person gets an email with a link and joins with one click. Pending invitations show in the Members list as Invited. You can withdraw one.

A person who signs up with a company email can ask the Owners of an existing organization for an invitation. The person does not join by themselves.

## Single sign-on

An Owner or Admin of a root organization can let people sign in with the identity provider of the company: Microsoft Entra ID, Google Workspace, or OpenID Connect. Passwords stay the default. See [Set up single sign-on](/guides/single-sign-on).

## Groups

Groups decide who can use which [Company Bot](/bots). An Owner or Admin creates them under Members, Groups, with Create group, and adds people to them. A person can be in several groups.

"All members" is a group that always holds everyone in the organization. You cannot change it. New bots start with it.

## Service accounts

A service account is an identity for a program, not a person. Create one under Members, Service accounts, with Create service account. Give it a name, a purpose, and permissions. You can create API keys for it. A [trigger](/triggers) can run as a service account.

## Audit log

Members, Audit log lists who did what: sign-ins to the Console and Chat, API keys created, revoked, or deleted, and changes to access. It also lists every time an Owner or Admin took access to the [Personal bot](/personal-bot) chats of other people, with the end time. The takeovers cannot be changed or deleted. See [Privacy](/privacy). Changes that GEKI makes to the organization show GEKI as who.

## Child organizations

A partner can create child organizations for its customers. A child has no Owner. Its highest role is Admin, and its Admins appoint other Admins. See [Partners](/partners).