OpenWork Cloud separates org membership from team assignment. Teams are used for skill hub and provider access; roles control what a person can manage across the org.

## Default roles

OpenWork Cloud comes with three default roles:

- `Owner`: full org control, including member roles and custom roles.
- `Admin`: can invite people, manage teams, and manage most shared Cloud resources.
- `Member`: can use resources shared with them but cannot manage org administration.

Only `Owner` can change member roles, remove members, or create, edit, and delete custom roles.

## Invite members

1. Open `Members`.
2. On the `Members` or `Invitations` tab, click `Add member` or `Invite member`.
3. Enter the teammate `Email`.
4. Choose the initial `Role`.
5. Click `Send invite`.

Invites are tied to the invited email address.

## Restrict who can join

If you only want teammates from specific companies or domains to join:

1. Open `Org settings`.
2. Turn on `Restrict allowed email domains`.
3. Add each approved domain to the `Domain allowlist`.
4. Click `Save settings`.

When this is enabled, OpenWork Cloud only lets people join with email addresses from the approved domains. Existing invites still target a specific email address, so both checks apply: the invitee must use the invited email address and that address must match the allowlist.

## Create teams

1. Open `Members -> Teams`.
2. Click `Create Team`.
3. Set `Team name`.
4. Choose `Team members`.
5. Click `Create team`.

You can use teams to control access to skill hubs and LLM providers without assigning people one by one.

## Use custom roles when needed

1. Open `Members -> Roles`.
2. Click `Create role`.
3. Enter `Role name`.
4. Choose the permissions that role should have.
5. Click `Create role`.

## Practical access pattern

A simple setup that works well for most orgs:

- keep 1-2 `Owner` users
- give day-to-day operators `Admin`
- keep most people as `Member`
- use `Teams` to decide who can see specific skill hubs or providers

## Notes

- You cannot change the org owner’s role or remove the owner.
- Owners and admins can manage teams and invitations, but only owners can handle the sensitive RBAC changes.
- Only owners can change `Org settings`, including allowed email domains and desktop restrictions.
- You cannot delete a custom role while members or pending invitations still use it.