Organizations

Organizations and Teams

Organizations are shared workspaces where teams collaborate on cloud instances, projects, and AI agents. Each organization has its own members, permissions, and resources.

What is an Organization?

An organization is a dedicated environment for your team to:

• Share cloud instances and resources
• Invite team members with controlled access levels
• Manage permissions through role-based access control (RBAC)
• Keep projects isolated and secure

Every Sencai user must belong to at least one organization.

Creating an Organization

Via the Dashboard

1. Log in to Sencai
2. On the dashboard header, find the Organizations menu or + New Organization button
3. Fill in the organization details:
   • Name — A unique name for your organization (e.g., “Acme Corp AI Team”)
   • Description (optional) — A brief description of the organization’s purpose
4. Click Create Organization

You’ll be automatically set as the Owner of the newly created organization.

Organization Roles

Every member of an organization has a specific role that determines what actions they can perform. There are five roles: Owner, Admin, Member, Viewer, and Auditor.

Owner, Admin, Member, and Viewer form a management hierarchy — each role includes everything the roles below it can do:

Owner > Admin > Member > Viewer

Owner

Full administrative control over the organization

• Invite, resend, and revoke invitations; remove members
• Promote or demote any member’s role
• Delete the organization
• Access all instances and resources
• Manage billing (if applicable)
• Cannot remove themselves without promoting another Owner first

Admin

Delegated management access, one level below Owner

• Invite new members and manage pending invitations (resend, revoke)
• View and manage instances and shared resources
• Cannot delete the organization
• Cannot manage billing

Member

Standard access to organizational resources

• View and manage instances (within their assigned permissions)
• Access shared tools and templates
• Participate in projects
• Cannot invite members or manage permissions
• Cannot access organization administration

Viewer

Read-only access to organizational resources

• View instances, projects, and shared resources
• Cannot make any changes, invite members, or manage permissions

Auditor

Read-only compliance role — outside the management hierarchy

Auditor is deliberately not part of the Owner/Admin/Member/Viewer mutation hierarchy above. It exists specifically for compliance and audit-trail visibility (e.g. for an external auditor or an MSP’s compliance team) and is intentionally narrower:

• Can view audit-relevant data but cannot perform any mutating action anywhere in the organization
• Cannot be granted through the ordinary invite dropdown — it’s assigned outside the standard invite flow so that read-only compliance access is never accidentally widened into a mutation-capable role
• Cannot be escalated to Owner/Admin/Member/Viewer or vice versa through normal role changes

Note

When you create an organization, you’re automatically an Owner. When inviting others, you choose from Admin, Member, or Viewer depending on how much access they need.

Inviting Members

Both Owners and Admins can invite new members and manage pending invitations — this is not restricted to Owners only.

Send an Invitation

1. Go to your organization’s Settings or Members page
2. Click Invite Member
3. Enter the email address of the person you want to invite
4. Select their role (Admin, Member, or Viewer)
5. Click Send Invitation

An invitation email is sent immediately to the recipient with an accept link. Under the hood this calls POST /api/organisations/:documentId/invitations, which requires the caller to hold at least the Admin role in the organization.

Viewing Pending Invitations

Owners and Admins can list all pending invitations for the organization (GET /api/organisations/:documentId/invitations) from the Members page.

Accepting an Invitation

If you receive an organization invite email:

1. Click Accept Invitation in the email (or copy the link)
2. If you already have a Sencai account, you’ll be added immediately
3. If you don’t have an account, you’ll be asked to sign up first; once registered, you’ll be added to the organization
4. The organization appears in your My Organizations list

Caution

Invitation links have an expiry. If a link expires before it’s accepted, an Owner or Admin can revoke the stale invitation and send a new one.

Managing Members

Viewing Members

1. Open your organization
2. Go to Settings → Members
3. You’ll see a list of all members and their roles

Changing a Member’s Role

If you’re an Owner:

1. Find the member in the members list
2. Click the role dropdown
3. Select a new role (Owner, Admin, Member, or Viewer)
4. Confirm the change

Auditor is not selectable from this dropdown — it’s a separate, deliberately narrower grant (see Organization Roles above).

Managing Pending Invitations

If you’re an Owner or Admin, you can revoke a pending invitation from the Members page before it’s accepted; this immediately invalidates the invite link. A “resend” option may also appear in the UI — confirm with the service owner whether it currently regenerates a working invite link end-to-end before relying on it, since this flow has had gaps in the past.

Removing a Member

If you’re an Owner:

1. Find the member in the members list
2. Click the Remove button (typically a trash icon)
3. Confirm the removal

The member loses access to all organization resources immediately.

Danger

Removed members can be re-invited, but they’ll have no access until a new invitation is accepted.

Agency / MSP Relationships

Organizations that manage infrastructure on behalf of other organizations (agencies, managed service providers) are connected through an organization relationship, separate from ordinary membership.

A relationship links a parent organization (the manager) to a child organization (the managed tenant) and has a type:

• managed-by — the parent organization actively manages the child organization’s resources
• partnership — a peer relationship between two organizations
• sencai-internal — a relationship used by the Sencai team itself, not a customer-facing agency

Each relationship carries a scope describing exactly which capabilities the parent is granted over the child, and a status (pending, active, suspended, revoked). The child organization’s owner must explicitly accept a proposed relationship before it becomes active — a relationship is never silently imposed.

This is what enables the MSP/agency workflow: an agency can operate across multiple customer organizations from one account, with each cross-tenant action scoped and auditable, rather than requiring separate logins or shared credentials per customer.

Note

Setting up an agency/MSP relationship between organizations is typically arranged with the Sencai team or configured by an organization Owner in Settings. Contact support if you don’t see this option and expect to.

Monthly Billing Summary

Once your organization manages at least one tenant through an active relationship, an Agency section appears in the sidebar with an Agency Billing page (/gravity/agency/billing). It gives you a monthly rollup of everything you manage, broken down per tenant.

Each summary lists, for every managed organization:

• Its subscription tier and monthly recurring revenue (MRR)
• Its number of active cloud instances
• Its billing model — Agency Billed (billed through your organization) or Customer Billed (billed directly to the tenant, you only manage it)

Above the per-tenant breakdown, the page also shows organization-wide totals for the period: total MRR, total managed tenant count, and counts of agency-billed vs. customer-billed tenants.

A summary is generated automatically on the 1st of each month. An Owner or Admin can also generate one on demand for a specific period using the Generate Summary button — running it again for a period that already has a draft updates that draft rather than creating a duplicate. New summaries start as Draft; an Owner or Admin can Finalize a draft from the same page to lock it in as the closed record for that period.

Note

This summary is an internal billing record for your own bookkeeping — it does not itself send an invoice or charge anyone.

Leaving an Organization

If you’re a Member:

1. Open your organization
2. Go to Settings → Members
3. Click Leave Organization
4. Confirm the action

If you’re the only Owner:

• You must promote another member to Owner before leaving
• Or delete the organization if it’s no longer needed

Organization Settings

Each organization has configurable settings (accessible to Owners):

• Display Name — The organization’s visible name
• Description — Internal notes about the organization
• Member List — Add/remove/change roles
• Billing (if applicable) — Subscription and payment information

Enterprise Security Settings

These settings are aimed at organizations with stricter security or compliance requirements. They’re managed from your organization’s Settings, and changing them is restricted to Owners/Admins.

SSO enforcement

If your organization has Google Workspace or EntraId SSO configured, an Owner or Admin can require that every member sign in exclusively through SSO — disabling plain email/password login organization-wide. See Enterprise Integrations for how to set up Google Workspace Directory Sync or the MS365/Entra ID admin consent flow that this enforcement toggle depends on.

1. Go to Settings → Integrations → SSO Enforcement
2. The toggle is only available once your organization actually has an SSO method configured (Google Workspace domain or an active EntraId/Microsoft 365 integration) — it can’t be turned on speculatively ahead of that
3. Enable it to require SSO for all members

This is enforced on the backend, not just hidden in the UI: once enabled, a password-based login attempt for a member of your organization is rejected before Sencai even contacts your SSO provider. Turning it off restores password login immediately.

Caution

Before enabling SSO enforcement, make sure every member of your organization can actually authenticate through the configured SSO provider — there’s no automatic fallback to password login once it’s on.

IP allowlisting

An Owner or Admin can restrict access to the platform to a specific set of IP ranges (CIDR notation, IPv4 or IPv6).

1. Go to Settings → IP Allowlist
2. Add one or more CIDR ranges (e.g. 203.0.113.0/24)
3. Save

By default, the allowlist is empty, which means no restriction — this is the backward-compatible default, so setting up IP allowlisting is entirely opt-in. Once you add at least one range, access from outside all listed ranges is rejected for members of your organization.

Danger

Double-check your own current IP is included before saving a non-empty allowlist — locking yourself out requires contacting support to recover access.

Audit log export

Organizations that need to produce their own audit trail for compliance (SOC2, ISO 27001, etc.) can export it directly from the platform.

1. Go to Settings → Audit Export
2. Choose a date range and optional filters (action, resource type, risk level)
3. Choose CSV or JSON format and request the export
4. Once ready, download it from the export history on the same page — download links expire after 7 days

Only your own organization’s audit trail is ever exportable this way — exports are scoped to your organization, the same as everything else in Settings.

Best Practices

• Multiple Organizations — Create separate organizations for different projects, clients, or teams. This isolates resources and improves security.
• Clear Ownership — Always have at least 2 Owners to prevent lockout if one Owner leaves
• Least Privilege — Invite members as Member or Viewer by default; grant Admin or Owner only when the person actually needs to manage invitations, billing, or the organization itself
• Regular Review — Periodically review your organization’s member list and remove inactive users

Troubleshooting

Q: Can I change an organization’s name after creation?

A: Yes. Owners can edit the organization name in Settings → General.

Q: What happens if all Owners leave an organization?

A: The organization becomes orphaned. Contact Sencai support to reassign ownership or delete it.

Q: Can I be part of multiple organizations?

A: Yes! You can belong to as many organizations as you want. Switch between them using the organization selector in the header.

Q: How many members can an organization have?

A: It’s limited, not unlimited — by whichever is lower of two independent caps:

• Your Organisation Plan’s member limit for that specific organization
• The organization owner’s personal User Plan limit on members per organization

If either limit is reached, new invitations are blocked with a “payment required” error until the relevant plan is upgraded. Upgrading the Organisation Plan alone won’t help if the owner’s personal User Plan is the stricter of the two — check both.