Organizations, teams and roles
How your account, your organization and permissions fit together.
Organizations, teams and roles
This is the "people and access" group from Start here: who's on your account and what they're allowed to do.
Organization
Every user, monitor, signal and issue in upzero belongs to exactly one organization. You get your first one by registering it through Zitadel; everything you do afterward is scoped to it automatically, with no separate step to select it.
Membership and roles
A person joins your organization as a member with one of four roles:
| Role | Roughly |
|---|---|
| Owner | Full control, including billing and deleting the organization |
| Admin | Manages settings and members, not billing |
| Editor | Creates and changes monitors, rules, dashboards and the like |
| Viewer | Reads everything, changes nothing |
Owner outranks Admin outranks Editor outranks Viewer: each role can do everything the ones below it can. Invite people from Organization; an invited member joins with whichever role you give them.
Teams
There's no grouping between "the whole organization" and "one person" yet. If you're picturing routing an alert to "the on-call team" specifically, that's not built today. Assign to individual people for now.
Service accounts
For a script, a CI job, or anything else that needs to call the API without a
human behind it, upzero has service accounts: non-human identities you create
from Organization → Service accounts, authenticated the
same OAuth way as a person but with a client id and secret instead of a
browser login. up0 auth login --client-id ... --client-secret ... uses one
instead of opening a browser.