User organizations

A user organization is a group of your users that holds access on their behalf, such as an employer and its staff, or a school. It is not your own organization, the account EdgeKit opens for you. The screen that lists them is Identity › Audience › Organizations.

How access reaches a member

A user organization can hold grants, like a user does. Each member reaches every grant the organization holds through their seat: the membership row is the seat record, and there is nothing else to fill in. A member’s own grants keep working beside the organization’s.

• A user can be a member of several user organizations.
• Each member has a role: owner, admin or member. Owners and admins invite and remove members through your site; a member does neither. A role changes what the person can manage in the organization, never what they can read: the organization’s grants reach every seat, whatever the role.

Seats and the seat limit

Occupancy is the number of members. The seat limit is a quota of membership.seats on a live grant the organization holds. A user organization with no such grant has no seat limit of its own. Today only checkout creates grants, and a checkout grant is held by the user who buys (see How a grant is created), so no user organization holds a seat quota yet and the 50-member ceiling below is the only one that applies.

Two ceilings apply, and the lower one wins:

• At most 50 members in any user organization, whatever was sold.
• The seat limit, when your organization’s seat overage policy is block, which is the default.

EdgeKit checks the ceiling when a member is added in one of three ways: an invitation is accepted, a user joins through an auto-join domain, or staff seat someone from the console. Under block, the add is refused when the organization is full. Under allow_and_flag, an invitation or an auto-join past the seat limit goes through, up to 50 members, and EdgeKit records a seat overage, shown in Identity › Audience › Observability as access.seat_overage. A staff seat from the console is never flagged; it is refused only at 50 members.

The policy applies to every user organization in your organization. You can read it, not change it, on any site’s screen in Delivery › Delivery › Sites, under Configuration › Access policy › Seat overage.

A person refused a seat at invitation accept or auto-join is recorded as a seat refusal, which the user organization’s owners and admins can list through the client API until the person holds a seat.

The Organizations screen

One row per user organization:

• Organization: name and slug.
• Domains: the email domains recorded for it, marked auto-join when they add members automatically. Invitation only means it has none.
• Created: when the user organization was opened.
• Pending: invitations offered and not yet accepted.
• Seats and Occupancy: the seat limit (no limit when the organization holds no seat quota) and the member count, marked over limit when there are more members than seats.

Search matches the name, the slug or a domain. Filter by Domains (auto-join, recorded only, none), Invitations (pending, none pending) and Seats (sold seats, no seat limit). Sort by name, occupancy, pending invitations or creation date.

A user organization’s screen

The page header shows occupancy against the seat limit, for example 12 of 10 seats, and is highlighted when the organization is over its limit. The screen has four tabs.

• Grants: the organization’s own grants, with stored status and status reason, offer code and expiry.
• Members: each member, their role and when they joined. See Seat a member and Change a member’s role.
• Invitations: invitations the organization’s owners and admins sent, with role, status, expiry and who sent them. An outstanding invitation does not hold a seat; the limit is checked when it is accepted. An invitation expires after 48 hours, and a user organization can hold at most 50 pending invitations at once.
• Domains: see Add an auto-join domain.

The Grants tab also shows Revoke and Delete organization. Neither can be used from the console today.

Open a user organization

Every change on the Organizations screen needs the Owner or Admin role.

1. In Identity › Audience › Organizations, select New organization.
2. Enter a Name, up to 200 characters.
3. Check the Slug. It follows the name until you type one, and it must be unique in your organization. EdgeKit stores it in lower case, with every run of other characters replaced by -.
4. Select Open organization.

The organization opens empty, on its Members tab. Seat its first admin there. Your site’s users cannot create a user organization themselves.

A slug another user organization already uses is refused with That slug is already taken..

Seat a member

Seating writes the membership directly. It sends no invitation and no email, so tell the person yourself.

1. Open the user organization from Identity › Audience › Organizations and go to Members.
2. Select Add member.
3. Enter the person’s Email and pick a Role. The role defaults to admin, because staff usually seat the first admin, who then invites the rest.
4. Select Add member.

If no user has that address yet, EdgeKit creates one, unverified and attached to no site. The person claims the account by signing in on your site.

Refusals:

• This organization is full at N seats.: N is 50, or the seat limit when it is lower and the policy is block.
• That person already holds a seat here.
• That is not an email address.

Change a member’s role

1. On the Members tab, select Change role on the member’s row.
2. Pick the new role and select Change role.

The new role applies from the member’s next request. It occupies no new seat and changes nobody’s access. An organization may be left with no owner.

Add an auto-join domain

A domain adds a user to the organization automatically when they register with a verified address at that domain.

1. On the Domains tab, select Add domain.
2. Enter the Domain: a hostname such as example.com, with no scheme, port or path, up to 253 characters.
3. Leave Auto-join on to add members automatically. Turn it off to record the domain without adding anyone.
4. Select Add domain.

How auto-join works:

• The match is exact: example.com does not match mail.example.com.
• It runs once, when the user row is created with a verified address. It never runs for an unverified address, and never for users who already exist when you add the domain.
• The new member gets the member role.
• When the organization is full, the user is still created, with no seat, and a seat refusal is recorded.
• A domain can belong to only one user organization. A second one is refused with That domain is already registered..
• EdgeKit does not ask for DNS proof. A user cannot claim a domain; only staff add one.

To stop a domain adding members, select Suspend on its row. The row stays, and Resume turns it back on. A domain is never deleted.

What members do themselves

A user organization’s owners and admins manage it from your site through the client API: invite and remove members, change roles, cancel invitations and list seat refusals. A member can leave, except the last owner. The invitee accepts with their own signed-in session and a verified address, so an invitation sent to one person cannot be claimed by another. Decide can keep reading the organization’s access from a removed member’s access cookie for up to an hour. EdgeKit staff cannot send an invitation from the console. See Let members run their user organization.