Members · K-Block Docs

Invite people to your organization, change their roles, remove them or leave, and understand the last-owner rule.

The Members page lists the people in your organization and their roles. Owners and admins also use it to invite new members, change roles and remove people.

Every member has exactly one role. The role decides what they can see and do in the dashboard and the Cloud API, and the Cloud API checks it again on every request: a change takes effect on the member's next request, without signing them out.

Roles

Role	In short
Owner	Everything, including the plan, the organization principal, observe settings and other owners
Admin	Everything except the owner-only actions: manages members, invitations, settings and policy activation
Approver	Reads the organization and decides approval requests that a policy routes to them
Developer	Builds: agents, MCP servers, tools, policy drafts, gateway API keys and webhooks
Viewer	Reads the organization

Being an owner or admin does not by itself make someone an approver of a request: each policy rule names who may approve. The full matrix is in Roles and permissions.

Who can do what on this page

Action	Owner	Admin	Approver, developer, viewer
See the member list	Yes	Yes	Yes
Invite, see and revoke invitations	Yes	Yes	No
Change a role	Any member, to any role	Non-owners, to any role except owner	No
Remove a member	Anyone	Non-owners	No
Leave the organization	Yes, unless last owner	Yes	Yes

Admins can promote other members to admin and demote or remove other admins. Only an owner can make someone an owner, or change or remove an owner; anyone else gets OWNER_REQUIRED.

The member list

Each row shows the member's name and e-mail address (with a You badge on your own row, and Disabled for a disabled account), their role, the date they joined, and a Remove or Leave button where you may use one. The last enabled owner's row has neither (see The last-owner rule). The count of members is shown at the top of the card.

Invite a member

Owners and admins see the Invitations card. Other roles see "Only owners and admins can invite members."

Start the invitation
Select Invite a member.
Enter the address and role
Enter the person's E-mail and choose a Role: Admin, Approver, Developer or Viewer (Viewer is preselected). The owner role cannot be given by invitation; make the person an owner after they join.
Send it
Select Send invitation. The invitation link is shown once, under Invitation link for the address.
Deliver the link
If K-Block e-mailed the link to the invitee, the notice says "The link was also e-mailed." If K-Block could not send it, the notice begins "The link was not e-mailed" and asks you to send it yourself: copy the link and send it to the invitee, for example over chat. Select I have stored it — hide when you are done.

An invitation sent from the dashboard expires after 7 days. Until then it is listed in the Invitations card with its address, role, state and expiry time. The card lists open invitations only, so the state is always pending: accepted, revoked and expired ones are not shown.

Why an invitation can be refused

Code	Meaning	What to do
`ALREADY_MEMBER`	The address already belongs to a member	Nothing; change their role instead
`INVITATION_EXISTS`	An open invitation for that address exists	Revoke it first, then invite again
`PLAN_LIMIT_EXCEEDED`	Members plus open invitations would exceed the plan. On Developer, every invitation is refused: Developer is for one user	Revoke an open invitation, remove a member or move to a larger plan (Startup or larger for a Developer organization)
`RATE_LIMITED`	Too many invitations in a short time	Wait and try again

An expired invitation for the same address is replaced automatically when you invite again.

An organization that has more members than its plan allows, for example after moving to a smaller plan, keeps them: K-Block never removes a member because of the plan, but refuses new invitations while its members and open invitations fill or exceed the limit.

Revoke an invitation

Select Revoke on an open invitation and confirm. The link stops working.

Open invitations are also revoked automatically when the member who sent them is removed, leaves or loses the owner or admin role.

Accept an invitation

The invited person needs a K-Block account with the invited address, and the address must be verified.

Sign in, or create an account with the invited address and verify it (see Your account).
Open the invitation link. The Accept an invitation page shows which account you are signed in as.
Select Accept invitation. You join with the role in the invitation, and the dashboard opens the organization.

If your address is not verified yet, the page asks you to verify it and then select I have verified my address — continue. If you are signed in with another account, select Use another account (or Sign in with another account) and sign in with the invited address.

Problem	What it means
This invitation is for another address (`INVITATION_EMAIL_MISMATCH`)	You are signed in with a different address than the invited one
Your address is not verified (`EMAIL_NOT_VERIFIED`)	Verify your address first
`INVITATION_EXPIRED`	The invitation has expired (7 days after it was sent from the dashboard); ask for a new one
`INVITATION_INVALID`	The link is unknown, was already used or revoked, or the person who sent it is no longer an enabled owner or admin
`ALREADY_MEMBER`	You are already a member
`PLAN_LIMIT_EXCEEDED`	The organization has reached its plan's member limit. A Developer organization takes no second member: an owner must move it to Startup or a larger plan first
No invitation token	The link was cut off; open the complete link

Change a member's role

Owners and admins see a role menu on each row they may change. Choosing a role that takes nothing away from the member, such as a promotion, saves it immediately. A role change that withdraws something the member holds asks for confirmation first and says what is withdrawn. For a developer made viewer, for example: "Change … to Viewer? Any gateway API keys they created are revoked, and any webhook endpoints they created are disabled. Giving the role back later does not undo this." Select Change role to save it or Cancel to keep the current role. The change is recorded in the audit log as member.role_changed.

To hand over ownership, an owner first makes another member owner, then changes their own role.

Remove a member or leave

Select Remove on a member's row (or Leave on your own). The confirmation says what is withdrawn, for example "Leave this organization? Any API keys and open invitations you created are revoked, and any webhook endpoints you created are disabled. Rejoining later does not undo this." (for someone else: "Remove …? … Inviting them again later does not undo this."). The confirming button is labelled Remove, or Leave when you leave. The member loses access on their next request. Their membership is deleted, and the change is recorded as member.removed or member.left.

After you leave, the dashboard opens another organization you belong to, or the page to create one if you have none.

What a role change or removal also does

K-Block withdraws what a person created when they no longer have the role to create it. This happens in the same step as the role change or removal. The dashboard's confirmation names what is withdrawn (see Change a member's role and Remove a member or leave).

Change	API keys they created	Webhook endpoints they created	Open invitations they sent
Removed, or leaves	All revoked	Disabled	Revoked
Becomes approver or viewer	All revoked	Disabled	Revoked (if they were owner or admin)
Becomes developer	Management keys revoked; gateway keys kept	Kept	Revoked (if they were owner or admin)
Becomes admin or owner	Kept	Kept	Kept

The last-owner rule

An organization always keeps at least one enabled owner. The Cloud API refuses, with LAST_OWNER, to change the role of the last owner or to remove them, and the last owner cannot leave. Disabled accounts do not count as remaining owners.

On the member list, the last enabled owner's role is shown as text instead of a role menu, and their own row says "Make another member owner before leaving." instead of offering Leave. The page can tell only once every page of members is loaded. If a change still reaches the Cloud API, it is refused, and the page shows "The member change was refused" with the reason "the organization's last owner cannot be demoted or removed; make another member owner first".

To leave an organization you own, make another member owner first.

K-Block has no way to delete an organization in this version.

Roles and permissionsWhat every role can do.API keysKeys depend on the person who created them.OrganizationsHow organizations, members and roles fit together.