People and roles
Invite people, assign roles and groups, reset access and lock accounts.
Manage people under People. Admins and owners can invite and edit people. Only owners can change another person's role to or from owner.
Roles
| Role | Can |
|---|---|
| Owner | Everything, including Settings: single sign-on, security rules, SCIM and audit streaming. |
| Admin | Manage servers, tools, policies, people and access requests. Approve calls. See all audit entries. |
| Auditor | Read everything, including the full audit log and settings. Change nothing. |
| Member | Use agents through Gatehouse, see their own activity, request access and approve calls when their group approves for a policy. |
The first account, created at /setup, is an owner. Keep at least two owners so you're never locked out.
Groups
Groups like engineering, sre or contractors decide which policies apply to someone and who approves calls. Pick groups when you invite or edit someone, or manage them under Groups. Groups can also come from Active Directory or LDAP, SCIM or your SSO provider's groups claim. See Groups.
Invite people
Click Invite people, enter work emails (one per line or separated by commas), pick a role and groups, and send.
- With SMTP configured, Gatehouse emails each person a link.
- Without SMTP, copy the link from the invite list and send it yourself.
The person chooses single sign-on or a password when they accept. Invites expire after 7 days and can be revoked any time.
With just-in-time accounts turned on, people from allowed domains can also sign in with SSO without an invite.
Help someone get back in
Open the person and use Security actions:
- Send a reset link. Valid for one hour and works once.
- Unlock. Clears a lockout after too many failed passwords.
- Reset two-step verification. They set it up again at their next sign-in.
- Sign out everywhere. Ends all their console sessions.
Disable someone
Disabling signs them out and revokes every agent token at once. Their audit history stays. Turn them back on later if needed. You can't disable or demote the last active owner.