Organizations

Every agent belongs to the organization it was created in. Membership of that organization, with the groups it puts a person in, is what gives them access to it: a member of a built-in group reaches every agent of the organization in that group’s role, any other member the agents their custom groups give a role on (see Roles and groups), and any other agent is answered as not found.

Signing in

Only a verified email address uses the platform. If your sign-in provider has not verified yours — you signed up with an email and password and have not opened the verification link yet — you see Verify your email address instead of the product: open the link in the email you received, then select I’ve verified it — sign in. Use another account asks for different credentials. An account still on the waitlist sees You’re on the waitlist the same way. With the Auth0 post-login Action the repository ships, a Microsoft work or school account counts as verified when its email is its sign-in name (UPN), which its organization proved it owns.

Your organizations

The first time you sign in with a verified email, the platform creates a personal organization for you and makes you its Organization Owner. It behaves like any other organization with a single member.

If an organization has invited you, or your email’s domain lets you join one (see Auto-onboarding), you get no personal organization on that first sign-in. The app opens on the invitation’s page instead, where you Join the organization or Dismiss the invitation (see Invitations). Join it, and that organization is your only one. Dismiss it, and your personal organization is created then and opens.

Whenever you belong to no organization — you have not answered an invitation yet, or you left or were removed from your last one — the app shows, in place of everything else:

with one pending invitation, that invitation’s page;
with several, a list of them, each opening its page;
with none, a way to create an organization of your own.

You can always sign out from there.

You can create more organizations with New organization in the organization control; you become the Organization Owner of each one you create. A person belongs to at most five organizations, the personal one included, and creating or joining a sixth is refused.

The active organization decides which agents you list and open, and which organization the Organization section manages. Switch it with the organization control in the icon rail, directly above the settings gear, or with the switcher on the agent list. The control’s menu lists every organization you belong to and marks the active one.

While an organization has invited you, the control’s icon carries a dot in the deployment’s brand colour, and its menu lists each organization that invited you below your own, with the same dot and Invited. Selecting one opens its invitation’s page, where you join or dismiss it; it does not switch you to that organization before you join.

What membership grants

Every member reads the member list and the groups. Everything else comes from the groups they are in, any number of them (see Roles and groups):

the built-in groups: Organization Owner manages the organization — its name, members, groups and domains — and administers every agent of it, with its connections, stored credentials and sessions; Administrator, Maintainer and User give that role on every agent of the organization; all but User also let their members create agents;
custom groups, each giving a role on the agents it names, as far as that role allows, and possibly Manage organization or Create agents.

The member who created an agent is shown as Created by on the agent list, and as Closed account once that person has closed their account. It is attribution only: creating an agent makes you Administrator of it through the agent’s own group, which can be changed like any other group. An agent stays with the organization when its creator leaves. A per-person limit, such as the design agent’s daily limit, counts the member who acts, never the creator of what they act on.

A person who joins by an invitation joins the invitation’s groups; one who joins by auto-onboarding joins the domain’s default group, if it names one. There is no platform administrator above the organizations: nobody, an operator included, reaches an organization without a membership in it.

Members and invitations

The Organization section of the Organization & Account page shows the organization’s name, and Members, a table with each person’s Name — tagged Organization Owner when they are one — Email, Groups (the built-in ones first) and when they were Last active. Every member sees it, five members to a page with the pending invitations on the first; renaming the organization and every control below need an Organization Owner.

An Organization Owner invites someone with Invite member, to the right of the Members heading: a dialog asks for an email address and any number of groups, built-in and custom, with User picked to start with. Inviting always creates a pending invitation and an invite link, copied for you to share and kept on the row behind Copy invite link; the address is listed as Invited, with its groups, until it is answered. Nobody is added on the spot, and the answer is the same whether or not the address already has an account, so inviting tells you nothing about who is registered. Inviting an address that is already invited renews that invitation for another 14 days, with the groups you pick and a new link, and the link shared before stops working; inviting a current member is refused. A person auto-onboarding offered membership is listed as invited too, and inviting them makes the offer your invitation.

Edit on a member’s row opens the same dialog with their address shown and their groups to change; saving puts them in exactly the groups picked. Edit on a pending invitation’s row does the same for the groups the invitee joins, and the link you shared keeps working. There is no role to pick on its own: the groups give it.

Every member sees which addresses are pending; only an Organization Owner can read their invite links. Revoke invitation withdraws one. Remove member takes a person out of the organization and out of its groups: they lose access to all of its agents immediately, and the agents they created stay. Nobody can be removed from their own personal organization.

Any member can leave an organization with Leave organization at the bottom of its Organization section, after a confirmation; they lose access at once and are switched to another of their organizations, or, with none left, shown their invitations or creating one. Your personal organization cannot be left, and neither can an organization by its last Organization Owner: put someone else in the Organization Owner group first.

Invitations

An invitation joins nobody until its invitee says yes. Opening the invite link signed out starts at signing up, with a link to sign in if you already have an account, and then shows the invitation’s page — the same page an invited organization in the organization control’s menu opens. It names the organization, who invited you (or that your email’s domain lets you join), the invited address, the expiry, the highest built-in group you join and the other groups, and what that means:

as an Organization Owner, managing the organization and every agent of it, with its connections, stored credentials and sessions;
as an Administrator, Maintainer or User, that role on every agent of the organization;
in no built-in group, the agents your groups give a role on, as far as those roles allow.

Either way, its members will see your name and email address. Join makes you a member in those groups and switches you to the organization; Dismiss answers no, and the link stops working. If that leaves you in no organization and with nothing else to answer, your personal organization is created and opens. An Organization Owner can invite you again.

An invitation answers only the address it was sent to, verified by the sign-in provider, so the link is not a pass for anyone who holds it. Signed in with another account, the page says This invitation is not for this account without naming the organization, and offers Sign in with another account. An unknown, expired, declined, revoked or used link answers This invitation is invalid, expired, or already used. An invitation is valid for 14 days.

Signing in never accepts an invitation. Every pending invitation to your verified address waits in the organization control’s menu, marked with that dot, so a lost link costs nothing.

Auto-onboarding

An organization that controls an email domain can offer membership to the people who sign up with it. The Auto-onboarding section of the Organization & Account page lists the organization’s domains in a table, each with its status as a tag beside its name — Verified, or Verification required — whether auto-onboarding is on, and its Default group. An Organization Owner adds and edits domains in one dialog:

Add domain at the top right asks for a domain, such as example.com. Once added, the dialog stays open on it, with a Verification required tag beside its name and a TXT record to publish at the domain’s DNS provider — the name _archmax-verification.example.com and a value starting archmax-domain-verification=, each with a copy action.
Once the record is published, Verify domain, at the bottom of the dialog, has the platform read it over DNS. Found, the domain is Verified; not found, it says the record isn’t visible yet. DNS can take a while to update, so verify again later, from the row’s edit action, if it is not found at first.
On a verified domain, tick Auto-onboarding — New users with a verified email at this domain are invited to join. — and choose the Default group newcomers join, or leave it at No group. The default group can be a built-in group, such as User for every agent, or a custom group for a few — never one that makes Organization Owners, since a domain admits whoever signs up at it. Save applies both.

From then on, a person who signs in for the first time with a verified email address at exactly that domain is offered membership. They get no personal organization; the app opens on an invitation page saying their email’s domain lets them join the organization, in the domain’s default group. Join makes them a member in that group — so the default group decides which agents newcomers reach, and without one they reach none until a group names them. Dismiss declines, and they get their personal organization instead. The offer is an ordinary pending invitation: it is listed in the Members table, its groups can be changed there, it can be revoked, and it expires after 14 days. Changing the default group affects offers made afterwards only. The person is offered membership only when the identity provider asserts that the domain’s owner manages the account they sign in with, in the managed-domain claim (ARCHMAX_MANAGED_DOMAIN_CLAIM). The Auth0 post-login Action the repository ships asserts it for:

a Microsoft work or school account (its email is its sign-in name, on a domain its organization proved it owns), or
a Google Workspace account of that domain.

Password accounts and personal Google accounts that use a work address are not offered membership: both stay with their holder after they leave the company. Invite them instead. A subdomain does not match (eu.example.com is not example.com). People who already had an account are not offered membership on their next sign-in, and neither is a member an Organization Owner removed. Verify domain can be selected ten times a minute, and special-use or private names (.local, .internal, .corp, …) cannot be added.

The platform reads the record again each time it offers someone membership. If the record is gone — the domain changed hands, or the record was removed — the domain goes back to Verification required and nobody is offered membership until it is verified again. If DNS cannot be reached at that moment, the person signs in without an offer, gets their personal organization, and the domain stays verified.

One organization at most holds a domain verified. Verifying a domain another organization holds is refused while that organization’s record is still published, and succeeds once it is gone. Any member can see the section, the domains and their default groups; only an Organization Owner can change them. Remove domain, the row’s delete action, stops auto-onboarding by it after a confirmation and withdraws the offers it made that are still pending; members who joined by it stay. Deleting a group clears it from every domain that names it as its default.

Without the DNS check

An operator of a single-tenant deployment can turn the DNS check off with ARCHMAX_DNS_VERIFICATION=off, for example where the platform cannot reach public DNS. A domain is then verified as soon as an Organization Owner adds it, no record is shown or read, and auto-onboarding offers membership without reading anything. Auto-onboarding still starts off on each domain until an Organization Owner turns it on. The API logs a warning at start while the check is off.

Personal chats

A chat a member starts on the Chat page, or in the editor’s chat surface, belongs to that member and is personal. The Sessions page marks it with a lock whose tooltip reads Personal chat — not visible to everyone. Every other session belongs to no member: a trigger firing, an endpoint caller, a manual start from the Sessions page, an evaluation case, a listen window.

The Sessions page, and a workflow’s session listing in the editor and the Evaluations view, show you your own sessions and the sessions that belong to no member; their totals count exactly what they show. A chat history shows only your own chats; another member’s chat is answered as not found, and its files are not available to you. Opening one of your own production chats from the Sessions page takes you to the Chat page with that chat selected. An agent’s Administrators (sessions:personal) are also shown other members’ chats in its session listings, but never in their own chat history. Access to an environment’s turns, decisions and files otherwise follows your role on the agent. See Sessions.

Your account

The Organization & Account page opens from the settings gear in the icon rail, or from the agent list before you open any agent. Its Account section shows your Profile, the name and email your sign-in provider supplies, and two actions:

Change password, offered only where the deployment signs people in at Auth0 and names its database connection (ARCHMAX_AUTH0_DB_CONNECTION), and only when you sign in there with an email and password, not through a social or enterprise identity provider. The platform never handles your password: it asks Auth0 to email you a link to choose a new one.
Close account, in red at the top right of the page while the Account section is open, after a confirmation. Your memberships and your account are removed, you leave every group, and every organization left without any member is removed with its agents. An organization that still has other members keeps its agents, even when you were its last Organization Owner. You are signed out, and this cannot be undone from the app.

Signing in again with the same identity after closing your account starts afresh: a new account, provisioned like any first sign-in, with nothing of the closed account restored. Sign out from the profile menu at the bottom of the icon rail.