Team Management
Formael is built for teams. Every person who needs to configure agents, review execution history, manage policies, or approve agent actions works within your organization through a named role.
Roles
Every member holds exactly one role. Roles are additive - each role includes all the permissions of the roles below it.
| Role | Who it's for | What they can do |
|---|---|---|
| Owner | Org founder, primary admin | Everything - including billing, SSO configuration, onboarding wizard, and ownership transfer |
| Admin | Team leads, ops engineers | Invite and remove members, manage agents, configure policies and credentials, manage approval groups |
| Member | Agent developers, platform users | Submit intents through agents, view their own execution history |
| Viewer | Auditors, stakeholders | Read-only access to execution logs, policy list, and approval queues |
Inviting a Member
Only Admins and Owners can invite new members.
- Go to Settings → Members
- Click Invite Member
- Enter the person's email address and choose their role
- Click Send Invitation
An email invitation is sent with a link that expires in 7 days. Until accepted, they appear in the member list with an Invited status.
Changing a Member's Role
- Go to Settings → Members
- Open the ⋮ menu next to the member and select Change Role
Role change constraints:
- Admins can change the role of Members and Viewers only
- Only an Owner can change an Admin's role
- The Owner role cannot be assigned through this flow - see Ownership Transfer below
Removing a Member
- Go to Settings → Members
- Open the ⋮ menu next to the member and select Remove Member
Access is revoked immediately. Their past activity is preserved in the audit trail.
Removal constraints:
- Admins can remove Members and Viewers
- Only an Owner can remove an Admin
- The last Owner cannot be removed - transfer ownership first
Ownership Transfer
The Owner role can only move through an explicit transfer. Organizations always have exactly one Owner.
Ownership transfer requires contacting [email protected]. A self-serve transfer flow is on the roadmap.
Approval Groups
Approval Groups route human-in-the-loop (HITL) approval requests to the right team. Without groups, all HITL requests notify all admins. With groups, each domain's requests go only to the people responsible for that domain.
Creating an approval group
- Go to Settings → Approval Groups
- Click New Group
- Enter a name (e.g., "Finance Approvers") and optional description
- Save
Adding members to a group
Open the group and use the Add Member button to assign organization members. Any member with an Admin or Owner role can be an approver.
Assigning groups to domains
Groups are assigned per domain in the Domains section of the console:
- Go to Domains and open the domain (e.g.,
finance) - In the Ownership & Routing panel, select the approval group
- Save
From this point, when an intent from the finance domain triggers HITL, only the Finance Approvers group is notified - not all admins.
Multiple groups and domains
A group can be assigned to multiple domains. A domain can only have one approval group at a time.
How Members Join Your Organization
The How joined column in the member list shows how each person was added:
| Value | Meaning |
|---|---|
| Self-registered | Created this organization during sign-up |
| Invitation | Joined via an email invite |
| Domain match | Auto-joined because their email domain is on your allowed list (Business+) |
| SSO | Provisioned automatically on first login via your identity provider (Enterprise) |
See Provisioning Settings for details on controlling how new members join.