Organisations, roles and teams

Everything in Obscenter belongs to an organisation: applications, machines, IoT devices, keys, channels, checks, objectives, workflows, dashboards and funnels. Services, processes, logs, traces and tickets belong to it through their machine or their application. A person can be a member of several organisations. The user menu switches between them, and the session remembers which one you are in.

How things join an organisation

Keys decide it. An application key, an agent key or a device key names an organisation, and whatever reports with it lands there. When you register, you get a new, empty organisation. The Install page then shows your own keys, so what you install is yours from the first report. See Getting started.

On obscenter.site each organisation has a plan: a 15-day free trial with 1 server, unlimited websites and mobile apps; then a licence — info@obscenter.site. How many hosts and applications it has is counted per organisation; see Plans and limits.

Roles

Role	Sees	Can change
Owner	Everything in the organisation	Everything, including other owners
Admin	Everything in the organisation	Accounts, keys, channels, policies and teams, but not owners
Member	What was granted to them or their teams, plus what they installed themselves	Within that, as their capabilities allow
Viewer	The same as a member	Nothing. Every write is refused.

A few rules protect the organisation from accidents:

• Only an owner can make, change or remove another owner.
• Nobody can take away their own administrator rights.
• The last owner cannot be demoted.
• Invitations can give the admin, member or viewer role, but never owner.

Removing someone from an organisation retires the agent keys they made there and revokes their API keys. It also deletes their grants and takes them out of its notification policies.

The install's administrator

Above every organisation sits the administrator of the install. On a self-hosted install, that is whoever ran the first setup. They can see and enter every organisation. Only they can see the install-wide settings: nodes, AI models, system health and limits, sign-ups, Google sign-in, the registration switch and fleet-wide agent settings. An organisation's admin never reaches those.

Capabilities

Each account has a list of capabilities that open whole sections of the product. They are edited under Settings → Accounts, in "What … may see and do". Owners and admins have them all. For a new member:

On by default	Off by default
Install agents and tags	Backend (machines, services, traces, logs and databases)
Synthetic checks	Console — a root shell
Topology	Profiling
Logs	Business logic
Databases	Automation (workflows, load tests and synthetic checks)
Problems	Security
IoT devices	API keys
Integrations

Some capabilities depend on others. Logs, Databases, Console and Profiling need Backend, and Synthetic needs Automation. A new member therefore does not see logs, databases or synthetic checks until Backend or Automation is ticked as well. A viewer never gets Install, Automation, Synthetic, API keys or Console, whatever is ticked. In the Launchpad, a page an account lacks shows a lock, and the lock says who can change it.

Grants

A member sees nothing until something is shared with them. In the same editor, tick the applications, services, machines and IoT devices they may see.

• A machine brings the services that run on it.
• An application brings the backend services it calls, as long as the member has Backend.
• A member also sees the machines, services and devices they installed with their own key, without anyone sharing them.

An API key a member makes sees exactly what its owner sees, and narrows when its owner is narrowed.

Teams

Under Settings → Accounts → Teams, an administrator groups people who are granted things together. A team has a name, members (people in the organisation) and grants of the same kinds as a person's. A member's access is their own grants plus their teams'. A team can only add access, never take it away. Teams are also a target for notification policies: "a team's things" as the scope, or the team as the recipients.

Who sees what

The Who sees what card adds every grant up and shows it from both ends. You can pick a person and see what they can open, or pick a machine or an application and see who can open it. It is computed with the same rule the server refuses by, so what it shows is what is enforced.

Managing accounts

Settings → Accounts lists the organisation's people. An administrator can add an account with an email, password and role, but inviting is usually better. See Invitations. Administrators can also block an account and set each account's alert mail. For an account that belongs to other organisations too, an organisation's admin may change its password or block it only if they are an admin in every organisation that account is in.