Agent-readable docs index: /llms.txt. Full docs in one file: /llms-full.txt. Download /docs.zip to grep all markdown files locally.

Users and groups

Use Users & groups to manage membership and job-based access. Owners and admins (administrators) can make changes; members see a read-only list of the workspace's groups and people.

Invite a user

  1. Select the intended workspace.
  2. Open Users & groups and select Invite user.
  3. Enter the person's company email address in Work email.
  4. Choose the minimum Workspace role required: Member or Admin. To make someone an owner, invite them first, then change their role after they accept.
  5. Select Send invitation.
  6. After the person accepts, add them to existing job-function groups instead of recreating access as direct exceptions.
An invitation does not grant tools by itself, and the person has no access until they accept. Effective access still depends on workspace policy, app availability, group grants, direct grants, and restrictions.
Invitations expire after 7 days. To accept, the invitee signs in with their company account; its verified email address must match the invited address and the workspace's domain.

Change a role or transfer ownership

Only owners can change roles. Open the person from Users & groups, open their Access tab, and select Edit access. On Profile & groups, choose Member, Admin, or Owner as their Workspace role, then select Save changes. You cannot change your own role. Role changes are recorded in Audit. Promotion to admin or owner does not grant tool access by itself.
There is no dedicated ownership-transfer feature. To hand off ownership:
  1. Promote the new owner.
  2. Have the new owner demote you.
Keep at least two owners at all times so the workspace is never one departure away from having no owner.

Create or change a group

Name groups for stable job functions such as service desk, billing, or security operations.
  1. In Users & groups, open the Groups tab, then select New group or an existing group.
  2. On Members, add the people who share the job function.
  3. On Access, grant only what the function needs: Full for an entire app, or Scoped to choose individual tools.
  4. On Restrictions, select Deny for tools the group must not run.
  5. Select Save group.
  6. Open a representative member and review their Access tab.
  7. Verify with a harmless read in Audit.
Prefer Scoped tool grants when the group does not need an entire app.

Plan access with your agent

Workspace owners and admins can ask their connected AI client:
Help me divide app access among our teams. Ask me about their work, then propose group permissions for me to review.
The agent can use the permission-planning skill to ask which people need access, which apps and tasks they use, and which actions should stay restricted. It can inspect existing groups, tool permissions, and app restrictions before proposing changes. It should ask a few questions at a time and leave uncertain permissions out of the proposal.
Review the exact people, groups, apps, and tool changes before approving them. The agent can create groups, change membership and grants, and adjust app restrictions through MCP. Every change requires confirmation, and Stackyapper checks that the caller is still a workspace owner or admin when it saves.
Prefer Scoped access for a specific job. Full app access also includes future tools that fit the current limits. App restrictions affect everyone using that app; they do not grant access or raise the workspace's limits. Removing one grant may leave access through another group or a direct grant.
After saving, ask the agent to check representative allowed and restricted tasks. Existing reviews, sensitive-tool approvals, restrictions, and per-call checks still apply. For private apps, use the app's Tools & access editor when the agent cannot inspect the exact operation or required approval.

Use direct user access sparingly

A direct user grant or restriction is an exception to job-based policy. Record why it exists and review it when the person’s responsibilities change. Restrictions win over grants.

Correct an invitation

Invitations that have not been accepted appear under Pending invitations below the user list, with their role, delivery status, and expiry date.
  • Select Resend to email the invitation again and restart the 7-day window.
  • Select Rescind to cancel an incorrect or unneeded invitation before it is accepted.
Expired invitations leave the list. To invite that person again, select Invite user. In a managed customer workspace, MSP administrators can also Resend or Rescind invitations under Recent invitations on the customer's page in Customers.

Remove a user from the workspace

Owners can remove anyone except themselves, so a workspace always keeps at least one owner. Admins can remove members, but not owners or other admins.
  1. Open Users & groups and select the person.
  2. Select Remove from workspace, review what removal does, and confirm.
Removal takes effect immediately. It deletes the person's workspace role, group memberships, direct grants, restrictions, and sensitive-action approvals, and transfers shared app connections they set up to you. Their API keys and portal sessions stop working for this workspace because both require current membership. The keys are not deleted and work again only if the person rejoins. Audit history is kept, and the removal is recorded in Audit.
If the person is provisioned by SCIM, also unassign or deactivate them in your identity provider.

Offboard a user

  1. Remove or suspend the company identity in the authoritative identity system.
  2. Remove the person's Stackyapper membership. If the workspace uses SCIM provisioning, deactivating the person in your directory removes their membership, groups, and direct grants and signs them out. Otherwise, remove them from the workspace.
  3. Removing the membership also stops the person's API keys from working in this workspace. If you need to cut off their AI clients before removing the membership, block them under AI clients > Access rules > User and group exceptions.
  4. Ask the person, if still available, to revoke their personal app authorizations at each provider, or revoke them from the provider's admin console.
  5. Review recent Audit activity and preserve required records.
See Understand access for the complete policy order.