Manage users and permissions

Invite users, create permission groups, and control what each group can access.

Updated October 29, 2026

Prerequisites: None.

Required permission: Admin Center access (organization owner or a member of the <org-name>-admins group).

Invite a user

Click your organization name at the bottom of the sidebar → Manage Organizations, then open your organization.
In the admin sidebar, click Users.
Click + Invite User.
Enter the user’s First Name, Last Name, and Email address.
Click Send Invitation.

The new user is placed in the organization’s default org_user group automatically — there’s no group picker on the invite form. Their status shows Invited until they accept. Assign them to additional groups afterward if they need more than baseline access — see Assign users to a group below.

If the invitation fails:

What you’ll see	Why	What to do
“User already belongs to the organization.”	This email is already a member here.	Nothing to do — find them in the Users list instead.
“Invited yourself? You’re already in this organization.”	You entered your own email address.	Invite a teammate instead; you’re already in.
Invite form rejects the email outright	The domain is a disposable/temporary address or a free consumer email provider — both are blocked.	Use the person’s work email address.

If the email already belongs to a user elsewhere on your Site but not in this organization, Tooling Metrics skips the standard invite email and sends a different notification — the person is added directly (“Existing user added to the organization. Notification sent to …”), with status Active if they’re already a confirmed user elsewhere, or Invited if not.

Approve an access request

If someone signs up on their own using an email domain your organization already owns, they don’t get an invitation — their membership is created with status Requested, and they can’t see any of your organization’s data until you approve them. See How domain-based access works for why sign-up works this way.

In the admin sidebar, click Users.
Find the person — their row shows Requested status and an Approve action.
Click Approve.

Their membership switches to Active immediately and they’re notified by email. There’s no separate “deny” action — leaving a request unapproved has the same effect as denying it; the person stays blocked from your organization’s data indefinitely.

Create a permission group

In the admin sidebar, click Groups.
Click + Create.
Enter a Name for the group (e.g., Engineers, Storekeepers).
Under Permissions, the record types are listed under their module headings (Production, Inventory, Purchase, Engineering, Library, Reports). For each record type, select the permission level: Admin, Manager, or User. Leave it at No permission to hide that record type from group members.
Click Create.

Administration is not one of the record types on this form — see How the Permissions Model Works for how Admin Center access actually works.

A group can’t be deleted while it still has members — remove everyone from it first.

Assign users to a group

In the admin sidebar, click Users.
On the user’s row or card, click the Add groups icon.
Search for each group and select it. You can add several groups at once.
Click Add groups.

To work from the group side instead, switch the Groups list to table view and click the add-user icon on the group’s row, then select the users and click Add users. To take someone out of a group, open the user (or the group) and click Remove from group next to it.

Permission levels

Level	What they can do
Admin	See all records of that type, create them, and edit or delete any of them
Manager	See all records, create them, and edit or delete the ones they created
User	See, create, edit, and delete only the records they created

Notes

A user can belong to more than one group. For each record type, the highest permission level across all their groups applies.
To temporarily remove a user’s access without deleting their account, use Suspend Access on the user record — this removes them from all of the organization’s groups and blocks login, while preserving their past activity. Use Restore Access to reinstate them.
For the full status list (Invited, Active, Requested, Suspended) and what each means, see Users Reference.