Organisations, roles and teams

Everything in Obscenter belongs to an organisation: applications, machines, IoT devices, keys, channels, checks, objectives, workflows, dashboards and funnels. Services, processes, logs, traces and tickets belong to it through their machine or their application. A person can be a member of several organisations. The user menu switches between them, and the session remembers which one you are in.

How things join an organisation

Keys decide it. An application key, an agent key or a device key names an organisation, and whatever reports with it lands there. When you register, you get a new, empty organisation. The Install page then shows your own keys, so what you install is yours from the first report. See Getting started.

An organisation of your own

Signed in, you can open another organisation from the user menu: New organisation. Give it a name and you are its owner; the dashboard switches to it, and your other organisations stay as they are. This is offered where registration is open, after your address is confirmed. On obscenter.site the same two terms boxes as on registration are ticked first, because a new organisation is a new agreement, and it starts with the free trial.

One account can own at most three organisations that have no licence (on their trial or past it). For a fourth, write to info@obscenter.site; a licence for one of them also makes room. The install's administrator makes organisations for other people on the Organisations card, by inviting their owner (see Managing accounts).

On obscenter.site each organisation has a plan: a 15-day free trial with 1 server, any number of websites and mobile apps; then a licence — info@obscenter.site. The trial starts when the organisation's first agent or tag reports. How many hosts and applications it has is counted per organisation; see Plans and limits.

Roles

Role	Sees	Can change
Owner	Everything in the organisation	Everything, including other owners
Admin	Everything in the organisation	Accounts, keys, channels, policies and teams, but not owners
Member	What was granted to them or their teams, plus what they installed themselves	Within that, as their capabilities allow
Viewer	The same as a member	Nothing. Every write is refused.

A few rules protect the organisation from accidents:

• Only an owner can make, change or remove another owner.
• Nobody can take away their own administrator rights.
• The last owner cannot be demoted.
• An organisation's invitations give the admin, member or viewer role, never owner. Only the install's administrator invites an owner, when making an organisation for somebody.

Removing someone from an organisation retires the agent keys they made there and revokes their API keys. It also deletes their grants and takes them out of its notification policies.

The install's administrator

Above every organisation sits the administrator of the install. On a self-hosted install, that is whoever ran the first setup. They can see and enter every organisation. Only they can see the install-wide settings: nodes, AI models, system health and limits, sign-ups, Google sign-in, the registration switch and fleet-wide agent settings. An organisation's admin never reaches those.

Capabilities

Each account has a list of capabilities that open whole sections of the product. They are edited under Settings → Accounts, in "What … may see and do". Owners and admins have them all. For a new member:

On by default	Off by default
Install agents and tags	Backend (machines, services, traces, logs and databases)
Synthetic checks	Console — a root shell
Topology	Profiling
Logs	Business logic
Databases	Automation (workflows, load tests and synthetic checks)
Problems	Security
IoT devices	API keys
Integrations

Some capabilities depend on others. Logs, Databases, Console and Profiling need Backend, and Synthetic needs Automation. A new member therefore does not see logs, databases or synthetic checks until Backend or Automation is ticked as well. A viewer never gets Install, Automation, Synthetic, API keys or Console, whatever is ticked. In All apps, a page an account lacks shows a lock, and the lock says who can change it.

Grants

A member sees nothing until something is shared with them. In the same editor, tick the applications, services, machines and IoT devices they may see.

• A machine brings the services that run on it.
• An application brings the backend services it calls, as long as the member has Backend.
• A member also sees the machines, services and devices they installed with their own key, without anyone sharing them.

An API key a member makes sees exactly what its owner sees, and narrows when its owner is narrowed.

Teams

Under Settings → Accounts → Teams, an administrator groups people who are granted things together. A team has a name, members (people in the organisation) and grants of the same kinds as a person's. A member's access is their own grants plus their teams'. A team can only add access, never take it away. Teams are also a target for notification policies: "a team's things" as the scope, or the team as the recipients.

Who sees what

The Who sees what card adds every grant up and shows it from both ends. You can pick a person and see what they can open, or pick a machine or an application and see who can open it. It is computed with the same rule the server refuses by, so what it shows is what is enforced.

Managing accounts

Settings → Accounts lists the organisation's people. Nobody is added with a password chosen for them: an administrator invites an address with a role, and the person chooses their own password from the link, or joins with the account they already have. See Invitations. The same holds for a new organisation the install's administrator makes: its owner is invited, and the organisation has no owner until the invitation is accepted. To make somebody an administrator of the install, invite them first, then tick it in their row's editor.

Administrators can also block an account and set each account's alert mail. For an account that belongs to other organisations too, an organisation's admin may change its password or block it only if they are an admin in every organisation that account is in. A person who forgot their password resets it themselves; see Forgot your password.