# Manage Users and Roles

Organization Admins can manage team members and their access levels from the **Admin** section of the Spyderbat Console, located at the bottom of the left-hand navigation panel.

<figure><img src="https://4237643999-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBmf9RZ2wNSc4znG5gBc1%2Fuploads%2Fgit-blob-02bed3cb7ef521b2f0a3cfb4954baffea12ac6ae%2Fadmin-nav-item.png?alt=media" alt="The Admin navigation item in the Spyderbat Console sidebar"><figcaption></figcaption></figure>

{% hint style="info" %}
Only users with the **Admin** role can see the Admin section and manage other users.
{% endhint %}

## Adding a user

1. Navigate to **Admin > Organization Management**.
2. Enter the user's email address.
3. Select a role from the **Roles** drop-down.
4. Click **Add User**.

<figure><img src="https://4237643999-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBmf9RZ2wNSc4znG5gBc1%2Fuploads%2Fgit-blob-a3f8b61efbeeb991c69d62d5e572f4a698bf381c%2Fadmin-add-user-form.png?alt=media" alt="The Add User form with email and role fields"><figcaption></figcaption></figure>

The user appears in the Accounts list and receives an email invitation to join your organization.

## Removing a user

Removing a user revokes their access to your organization. It does not delete their account — user accounts belong to the individual and can be members of multiple organizations.

1. In **Admin > User Management**, hover over the user's row.
2. Click the **delete** icon.
3. Confirm the removal.

{% hint style="info" %}
Removed users do not receive a notification email. If they have an active session, they are immediately logged out.
{% endhint %}

## Changing a user's role

1. In **Admin > Organization Management**, find the user in the Accounts list.
2. Click the **Roles** drop-down on that user's row.
3. Select the new role.
4. Deselect the old role.
5. Click **Save**.

<figure><img src="https://4237643999-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBmf9RZ2wNSc4znG5gBc1%2Fuploads%2Fgit-blob-a90ed4b9065ecc09b88f5a647073af21e019645d%2Fadmin-change-role.png?alt=media" alt="The role change dropdown showing available roles and Save button"><figcaption></figcaption></figure>

{% hint style="info" %}
If you don't deselect the old role, the user has both roles assigned. The higher-permission role applies, which may grant more access than intended.
{% endhint %}

## Roles and permissions

Spyderbat has five organization-level roles. The table below summarizes what each role can access:

<figure><img src="https://4237643999-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FBmf9RZ2wNSc4znG5gBc1%2Fuploads%2Fgit-blob-7f84bf8bcff78cbcb6a4c35460f7cd1458f91eb7%2Fadmin-role-dropdown.png?alt=media" alt="The role dropdown showing all five available roles"><figcaption></figcaption></figure>

| Capability                               | **Admin**   | **Power User** | **Non-API User** | **Agent Deployment** | **Read Only** |
| ---------------------------------------- | ----------- | -------------- | ---------------- | -------------------- | ------------- |
| Organization and user management         | Full access | No access      | No access        | No access            | No access     |
| Source management and agent installation | Full access | Full access    | Full access      | View and add         | View only     |
| Agent health monitoring                  | Full access | Full access    | Full access      | View only            | View only     |
| Dashboards (view and create)             | Full access | Full access    | Full access      | No access            | View only     |
| Search queries                           | Full access | Full access    | Full access      | No access            | View only     |
| Investigations (process and K8s)         | Full access | Full access    | Full access      | No access            | View only     |
| Notification setup                       | Full access | No access      | No access        | No access            | No access     |
| Guardian policy management               | Full access | Full access    | Full access      | No access            | View only     |
| API key creation                         | Full access | Full access    | No access        | Full access          | No access     |

### Admin

Full access to all console features. Admins can invite and remove users, change roles, manage sources, configure notifications, and perform all investigative and administrative actions.

{% hint style="warning" %}
Limit the number of Admin users in your organization. One or two Admins is typically sufficient.
{% endhint %}

### Power User

Full access to all console features except organization and user management. Power Users can manage sources, create dashboards, run searches, conduct investigations, and create API keys.

### Non-API User

Same access as Power User but cannot create API keys. Use this role for team members who need full console access without programmatic API access.

### Agent Deployment

A limited role for onboarding engineers responsible for installing Spyderbat Nano Agents. These users can view and add sources, access agent install scripts, and monitor agent health. They cannot access dashboards, search, or investigations.

### Read Only

View-only access to most console features — dashboards, sources, agent health, investigations, and search. Read Only users cannot modify data (e.g., rename sources, archive machines) and cannot access the Admin section.