Members & access
Inviting members
Section titled “Inviting members”Organization → Members → Invite sends an email invite (valid 7 days). Assign role and department at invite time. For many people at once, use the spreadsheet bulk import.
Seats are billed per member; adding a member beyond your seat count either blocks with a clear message or (if you enable auto-expand in billing) provisions the next seat automatically and bills it next cycle.
Approved access domains
Section titled “Approved access domains”Skip invite round-trips entirely: claim your company’s email domain, prove it with a DNS TXT record shown in Settings → Domains, and every verified signup on that domain gets a “request to join your organization” prompt. Requests land in a queue for admins to approve or decline. Nobody enters without an explicit decision on both sides.
Free-mail domains (gmail.com etc.) can’t be claimed, and each domain can only be claimed by one organization.
Departments
Section titled “Departments”Group members into (optionally nested) departments with a manager. Department structure drives what managers can see and how leads round-robin within a team.
Roles and permissions (Enterprise)
Section titled “Roles and permissions (Enterprise)”Every member holds one of three roles. Admins can do everything; managers work with the team data in their departments; employees work with their own. On Enterprise, Organization → Users → Roles lets an admin shape the two lower roles and add custom ones:
- Customize Manager or Employee. Each role lists every permission grouped by area (pipeline, growth, brand, insight, messaging, automation, and so on) with a switch per permission. Turning one on that the role does not hold by default grants it to everyone with that role; turning one off removes it. A customized role shows a “Customized” mark and can be reset to the default at any time.
- Create a custom role. Duplicate Manager or Employee, give it a name (for example “Field rep”), and adjust its permissions. Assign it to a member from their profile, or at invite time. A custom role is always built on a base role: the base role and departments still decide which records a member can see, the custom role decides which pages and actions they get.
- What never changes. Billing, organization settings, integrations and credentials, the audit log, and role management itself always stay with admins. The Admin role cannot be narrowed.
Changes apply immediately to every member with that role, including assistants that use the organization’s MCP tools. If the organization leaves the Enterprise plan, roles revert to their defaults; the customizations are kept and come back when the plan is restored.
SSO and SCIM (Enterprise)
Section titled “SSO and SCIM (Enterprise)”- SAML single sign-on is configured per organization in Settings → Single sign-on: works with Okta, Entra ID, Google Workspace, and any SAML 2.0 IdP.
- SCIM provisioning keeps membership in sync from your IdP: joiners get seats, leavers are deactivated automatically.
Audit trail
Section titled “Audit trail”Organization → Audit log (admins) records who did what: membership and role changes, department moves, pay plan edits, company, deal, quote, custom field, price book, pipeline stage and booking pool changes, single sign-on and SMTP settings, Slack and Teams connections, and every export.
A member’s profile shows their own activity in both directions: what they did, and what was done to them, such as a role change by an admin. Managers see this for the members they manage. Pay plan rows stay with admins and the member themselves.
Credentials never appear in the log. A change that only refreshed a token is not recorded as an event.
Offboarding
Section titled “Offboarding”Removing a member frees their seat and keeps their captured leads and cards with the organization. Managed cards can be reassigned to another member.