# Organizations and members (https://docs.ctxpipe.ai/docs/managing-organization)

An **organization** is the access boundary for Workspaces, connections,
conversations, and MCP. A person can belong to more than one organization, and
switch between them with the organization switcher.

* Each organization has a name and a unique URL slug.
* Workspace and connector pages always work inside the organization in the URL.
* Each member of an organization can open each of its
  [Workspaces](/docs/workspaces).

## Invite by email

Open **Organization settings → Members** and send an invitation. The invited
person gets an email with a link.

* If they have an account, the link adds them to the organization with the
  role of the invitation.
* If they do not, they sign up first with the same email. ctxpipe then applies
  the invitation.

## Roles

Each member has one role in each organization:

| Role       | What the role can do                                                                                                                  |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| **owner**  | All that an admin can do. Also delete the organization.                                                                               |
| **admin**  | Manage members and invitations. Add and remove connections, and start a sync. Start Workspace upgrades. Create organization API keys. |
| **member** | Open and use the Workspaces of the organization, and chat in them. See the status of connections and upgrades.                        |

Admin actions need a signed-in browser session. An API key or an MCP token
cannot do them, even when its owner is an admin.

## Access follows membership and source scope

Membership gives a person access to the organization in ctxpipe. It does not
give access to more content in your tools:

* the GitHub App installation controls which code ctxpipe can read;
* the scope of each source controls which Linear, Notion, Confluence,
  PagerDuty, Buildkite, or Plain content ctxpipe mirrors;
* the permissions of the Workspace repository control who can read the
  mirrored content in git;
* Slack captures need the bot in the channel.

Use roles to control administration in ctxpipe. Keep the permissions of your
tools, and the audience of each Workspace repository, as narrow as you need.

An MCP client reads only the organizations that you selected for it, and only
while you are a member. See [Connected apps](/docs/mcp/connected-apps).