Organizations

An organization is the tenant boundary of K-Block Cloud. Everything you configure or record belongs to exactly one organization: its agents, MCP servers and tools, policies, delegations, actions, approvals, receipts, API keys, webhooks, members and audit log. One organization can never see or reference another organization's records.

You need an organization before you can protect anything. Most teams use one organization per company or team; you can belong to several and switch between them.

What an organization holds

Each organization has an ID, a name and a URL slug. The slug is fixed when the organization is created; you can rename the organization later, but not change its slug.

The organization principal

The principal is the organization's cryptographic identity: a K-Block identity whose public part is stored by K-Block Cloud and whose private key is kept only in the browsers where owners and admins generated or imported it, and in the key backups they export. Like every key kept in a browser, it is only as safe as that browser profile: anything that runs code on the dashboard's pages there can use and copy it (see How the browser stores keys). It is identified by a KID, the key identifier described in Identities and KIDs.

The principal is how the organization grants authority. An agent can only perform protected actions under a delegation signed by the organization's current principal. The principal also signs revocations of delegations and cancellations of actions that are pending approval or approved but not yet executed. K-Block Cloud verifies these signatures. The Cloud API and K-Block's database never receive or store the principal's private key: the key is generated, stored and used in your browser by the dashboard's code (see How the browser stores keys for what else can use it there). K-Block Cloud does record which identity is the organization's current principal, and an owner can replace that identity at any time without the previous principal's key (see the callout below).

A new organization has no principal. Until an owner sets one, no agent can be authorized.

1. Generate the principal

   An owner opens Settings and, in the Organization principal card, selects Generate principal in this browser. The private key is generated in that browser and only the public identity is sent to K-Block Cloud. Only owners can set the principal.

2. Export a key backup

   Export a key backup from Account → Key backup. Without a backup, losing the browser's storage means generating a new principal and re-authorizing every agent.

3. Sign delegations

   Owners and admins whose own account holds the principal key in their browser can sign delegations on each agent's page. To sign from another browser, or as another owner or admin, import the key backup there while signed in to your own account (Account → Key backup, Import keys).

K-Block Cloud accepts delegations, revocations and cancellations from signed-in owners and admins, provided they are signed by the principal. An admin can therefore sign once an owner gives them a key backup that contains the principal, with its passphrase passed on separately, and the admin imports it in their own browser, signed in to their own account. A copy that another account stored in the same browser profile is not used for them. Decide deliberately who holds that key, and replace the principal if someone who holds a copy should no longer have it.

Create an organization

Any signed-in user with a verified e-mail address can create an organization. The creator becomes its owner, and the new organization starts on the Developer plan with no principal.

1. Open the form

   Open the organization switcher at the top of the dashboard and select Create organization.

2. Name it

   Enter a Name and check the suggested URL slug. A slug is 2–63 characters: lowercase letters, digits and dashes, starting with a letter or digit.

3. Create it

   Select Create organization. The dashboard makes the new organization your active one and opens it.

If you enter a slug that another organization already uses, the request fails with SLUG_TAKEN and you can choose another. If you leave the slug out (through the API), K-Block derives one from the name and adds a random suffix.

Switch between organizations

The organization switcher lists every organization you are a member of, with your role in each. Selecting one opens it; the dashboard also records it as your session's active organization. Your role, and therefore what you can see and do, can differ from one organization to the next.

Members and roles

People join an organization by invitation. Owners and admins invite by e-mail address and choose a role; an invitation is valid for seven days by default and cannot grant the owner role. Owners make other members owners.

Developer is for one user. Team membership starts with Startup. The free Developer plan has room for one member, the owner who created the organization, so invitations are refused (PLAN_LIMIT_EXCEEDED) and the owner does every task, including deciding approval requests when the policy's approval rule admits owners. To add people, an owner moves the organization to Startup or a larger plan.

An organization always keeps at least one enabled owner: the last owner cannot be demoted, removed or leave (LAST_OWNER). Any other member can leave at any time. The full matrix is in Roles and permissions; managing members in the dashboard is described in Members.

Plan and limits

Every organization has a plan. Without a verified subscription it is on the free Developer plan: 500 protected actions a month and one member, the owner. Developer is for one user. Team membership starts with Startup. The plan limits how many protected actions the organization can record each calendar month (UTC), and how many members (open invitations included), API keys that are not revoked, webhook endpoints, agents, MCP servers, tools and policies it can have.

Disabled agents and tools count toward these limits too. Agents, tools and policies cannot be deleted in this version (tools are deleted only with their MCP server, and only while none of them has a recorded action), so an organization that reaches the agent, tool or policy limit cannot add more on its plan.

The monthly count includes denied actions and calls made with test API keys. When the limit is reached, new calls are refused with PLAN_LIMIT_EXCEEDED and nothing is recorded. The plan also sets a data-retention period: after it, the operational data and the hosted evidence (signed objects, receipt bundles) of finished actions are removed, while a minimal record of each action and the audit log are kept, and receipts you downloaded stay verifiable (see Data retention). Moving to a smaller plan deletes nothing either: what the organization already has stays, and only new items over the smaller plan's limits are refused.

Only owners can change the plan. An owner chooses a paid plan on Billing and pays on the checkout page of Creem, K-Block's billing provider; the plan changes once Creem confirms the subscription. Owners change or cancel a subscription in Creem's customer portal. If the Billing page says Billing is not configured in this environment, paid plans cannot be bought or managed in the dashboard: organizations without a verified subscription stay on the Developer plan, and a refused plan change shows "Plans cannot be bought or managed here right now." If your organization needs a paid plan, contact K-Block support; if a plan change was refused, give them the request ID shown in the error. See Billing and Limits and supported versions.

Settings

Turning observe off or withdrawing the live opt-in ends every open observe window; lowering the longest window ends the open windows that are longer than the new limit. These settings are edited on the Settings page; see Settings, Observe and shadow and What agents are told.

Deleting an organization

K-Block does not support deleting or archiving an organization in this version. There is no dashboard control and no Cloud API route for it, and K-Block never deletes an organization's evidence (audit events, signed records and delegations). An organization stays in place even when it is no longer used.

Next steps