> ## Documentation Index
> Fetch the complete documentation index at: https://docs.horizon.prefect.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Members
> Invite, remove, and manage people in your organization.
export const teamCollaborationPlans = "Developer and Enterprise";
export const serverRolesPlans = "Enterprise";
Organization member invitations are available on {teamCollaborationPlans}.
Team server grants are available on {serverRolesPlans}.
Members are people who can sign in to an organization. They can join through an
invitation or [Directory Sync](/administration/directory-sync). Membership
determines which organizations a user can see, which settings they can manage,
and which servers they can access through organization and server roles.
## Membership contract
Membership gives a person access to an organization. It does not automatically
grant access to every restricted server unless the person is an organization
admin or the server has a default role.
| Property | Contract |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Organization boundary | A user must be a member of the organization to access its Horizon resources. |
| Organization role | Admin or Member defines the user's organization-level baseline. |
| Server access | Non-admin members need explicit grants, team grants, or server default roles. |
| API keys | [Personal API keys](/api-keys#key-types) use the user's current access. Removing a member removes the key's access to that organization but does not revoke the key. |
| Organization removal | Removing a member removes their organization membership, explicit server grants, and Horizon-managed Team memberships. Horizon keeps directory Team assertions because the identity provider still owns them, but they grant no access without organization membership. The current [billing contact](/billing-contact) must be reassigned first. |
| User deletion | Deleting the Horizon user removes all Team membership rows, including directory assertions. A later directory sync recreates a pending assertion if the identity provider still assigns that email to the group. |
Use service accounts for durable automation. User-owned
keys should stop being relied on when that user leaves the organization.
## Member lifecycle
Organization admins can invite a person by email. An identity provider can
also provision them through Directory Sync.
An invited person joins after accepting the invitation and completing
sign-in. A directory-provisioned person joins when Horizon receives their
active WorkOS organization membership.
Give the member an organization role and, when needed, explicit server grants
or team grants.
Use users and request logs to understand how the member's clients interact
with deployed servers.
Removing a member removes their organization membership, explicit server
grants, and Horizon-managed Team memberships. Horizon keeps directory Team
assertions because organization removal does not change identity-provider
groups, but those assertions stop granting access. Reassign the billing
contact before removing the member who currently holds it.
## Invitation states
| State | Meaning |
| -------- | -------------------------------------------------------------------------- |
| Pending | The invitation has been sent but not accepted. |
| Accepted | The invited person joined the organization. |
| Expired | The invitation can no longer be accepted. Send a new invitation if needed. |
| Revoked | An admin canceled the invitation before it was accepted. |
## Roles
| Role | Contract |
| ------ | --------------------------------------------------------------------------------- |
| Admin | Can manage organization settings and has full server access. |
| Member | Can access servers through explicit grants, team grants, or server default roles. |
Server-level roles can further grant `admin`, `editor`, or `viewer` access to a
specific server. See [Authorization](/platform/authorization) for the full
resolution model.
## Access changes
Organization removal and user deletion use different boundaries.
Organization removal keeps identity-provider group assertions because the person can still belong to those groups.
User deletion removes all local Team membership state so a replacement user cannot inherit stale access before directory sync confirms it.
| Change | Effect |
| ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Promote member to admin | The user gains organization management access and full server access. |
| Demote admin to member | The user loses admin bypass and must rely on explicit grants, team grants, or defaults. |
| Remove explicit server grant | The user may still retain access through a team grant, server default role, or organization admin role. |
| Remove member from organization | The user can no longer access organization resources. Horizon removes explicit server grants and Horizon-managed Team memberships. Directory Team assertions remain pending and cannot grant access. Horizon requires the current billing contact to be reassigned before removal. |
| Delete Horizon user | Horizon removes all Team membership rows for the user, including pending directory assertions for their email. Directory sync can recreate valid assertions from the identity provider. |
| Reinvite removed user | New membership does not restore prior explicit server grants or Horizon-managed Team memberships. Directory Team access can return when the identity provider still assigns the person to the group. |
## Reviewing members
Review membership from three directions:
* Organization view: who can sign in, who is admin, and who counts toward seats.
* Server view: which people have explicit access and with what role.
* Teams view: which groups a person belongs to and which servers grant access to
those Teams.
For sensitive servers, review explicit grants, team grants, and the server
default role together. A restrictive explicit grant is not useful if a Team or
the server default gives the person broader access.
## Operational guidance
* Give admin access only to people who should manage billing contact assignment,
organization settings, integrations, and access.
* Use explicit server grants or team grants for members who need access to
restricted servers.
* Remove members promptly when they leave the organization.
* Use service accounts for automation instead of adding
shared human accounts.
## Related docs
Group members and review their shared server access.
Review the role model used by Horizon.
See the full access resolution model for users and servers.