Members and teams

A member is a person in your Verdictan organization. A team is a group of members who do related work. Give a team a role, and every member of the team gets that role's permissions, including people who join later.

For example, give a support team an evidence-review role. A new support engineer who joins the team can review evidence without a direct role assignment.

Before you start

You need users:invite to invite, users:manage to change members, and teams:manage to change teams. The matching read permissions let you see the lists. Create the roles you want to assign first.

Invite a teammate

1. Open IAM → Members and select Invite member.
2. Choose Single, or Batch for several people.
3. Enter the email address.
4. Choose the Org role. An invitation cannot give the Owner role.
5. Select Send Invite.

The invitation stays pending until the person accepts it. Then check their membership and role. If your organization requires SSO or MFA, the member completes those steps at sign-in.

If an invitation stays pending, check the address, the expiry, and your sign-in policy, and send it again.

Invite directly into a team with the CLI

Sign in with verdictan auth login, then use role and team IDs from your organization:

verdictan user invite \
  --email analyst@example.com \
  --role-id <role-id> \
  --assignment-level team \
  --assignment-target-id <team-id>

This sends a real invitation, so change the example address first.

Create a team

1. Open IAM → Teams and select Create team.
2. Enter a name, such as Support reviewers, and a short description.
3. Save the team and open its page.
4. Add members.
5. Assign a role.

The team page shows its members and role. A team without a role gives no permissions.

From the CLI, create the team first:

verdictan team create \
  --name 'Support reviewers' \
  --description 'Review support request outcomes'

Then use the returned team ID to add members and assign roles.

Examine a member

A member's page has the tabs Permissions, Teams, Security, and Tags, and shows Last accessed. A pending member also has an Invitation tab.

Use status and activity to find accounts to review, but keep in mind:

• A missing activity value does not prove that an account is unused.
• Team membership does not show direct roles.
• An MFA label shows enrollment, not sign-in history.

Change a member's access

When a member changes jobs:

1. Assign the new team or role.
2. Check the new access with the member.
3. Remove the old assignment.
4. Check their remaining direct and team permissions.
5. Find the change in Trail.

If access must stop right away, suspend the member first.

Suspend, restore, or remove access

Action	Use it when
Suspend	Access must stop, but the person may come back.
Reactivate	A suspended member is approved to return.
Remove from team	Access through that team must end. Other roles may still grant access.
Remove from organization	The membership must end.

Before you remove a member, hand their responsibilities to someone else, and review their tokens, sessions, OAuth grants, teams, and owned resources. Keep the work and audit records you need. Then select Remove from organization on the member page and confirm the result in Trail.

CLI operations

Use the member ID from verdictan user list:

# Stop access. This changes the member's status.
verdictan user suspend --user-id <user-id> --yes

# Restore a suspended member after approval.
verdictan user reactivate --user-id <user-id>

IAM commands covers removal and the other operations.

Change members together

In the member list, you can suspend, change the role of, or remove several eligible members at once. Review the selected members and the planned change first. Owners and other protected accounts can be left out.

Check the per-member results and Trail afterwards. A completed bulk action does not mean that every selected member changed.

Verify access

Check the member's status, teams, and effective permissions. Then, with an account that is not an owner, do one allowed action and one action that no policy allows. Find the change in Trail.

Troubleshooting

Problem	What to check
An invitation stays pending	The address, expiry, domain limits, and SSO requirements. Send a corrected invitation, and revoke ones you do not need.
A member keeps access after leaving a team	Another team or a direct role grants it. Look at Permissions.
A returning member cannot sign in	The account status. If it is suspended, select Reactivate.
A bulk action skipped a member	The eligibility result. Owners have their own procedure.

Next steps

• Roles and IAM Policies: define what a team may do.
• SSO and SCIM: manage members from your company directory.
• MFA and Passkeys: protect sign-in.