Org admin overview
What organization admins control and how the permission hierarchy works.
The permission hierarchy
There are three layers of administrative control. Each layer can restrict what the layer below it does — but can never grant more than what it has been given itself.
| Layer | Who | Where |
|---|---|---|
| Org Admin | IT admin at your company | Organization settings |
| Team Admin | Team owner or team admin | Team settings |
| End User | Employees and users | Everything else |
As an org admin, you set the rules for everyone in your organization. Team admins can tighten things further for their teams, but they cannot exceed the limits you set.
What org admins control
From Organization settings, you control:
- People — members and their roles (Member, Admin, Guest), teams, and manager assignments
- Connections — which external services are available to your organization, how much access each one grants, your company-wide Microsoft 365, Slack and Teams setup, and the default Autonomy Matrix
- Skills & Workflows — which skills users can browse, install, create and share, plus skills installed for the whole org
- SSO & SCIM — single sign-on and automated user provisioning
- Settings — organization name, shared organization context for assistants, default model tiers, verified email domains and API keys
- Audit Logs — a record of administrative and account activity, with optional delivery to your own S3 bucket
How settings resolve
When the platform evaluates what a user can do, it walks the hierarchy from bottom up:
- Does the user's team have an explicit override? Use it.
- Does the org have a setting? Use it.
- Fall back to the developer's platform default.
Team admins can set each toggle to Inherit (take the org value), On, or Off. They cannot set something to On if the org has it Off. Some org settings can also be locked, which stops team admins and users from changing them.
Who is an org admin?
Org admin access is granted by the developer when provisioning your organization, or by another org admin via Organization → People → Members, where each member has a role of Member, Admin or Guest. Org admins see Organization in their account menu. Regular users do not.