Organization Users & Access

Manage who can access an organization and which fixed role they hold.

Overview

Weave uses role-based access control (RBAC). A user account is global, while access and roles are scoped to an organization (called a tenant in APIs and storage). A user can be invited to multiple organizations and can hold a different role in each one.

JSON Web Tokens (JWTs) contain only the user ID. The active organization is passed through the X-Tenant-ID header, and permissions are evaluated against the user's role in that organization.

An organization seat represents one person with control-plane access. Active users and reserved pending invitations consume seats. Devices and WireGuard peers do not consume seats; they are controlled by the device quota.

RBAC Role Hierarchy

Role	Inherits	Description
viewer	—	Read-only access to devices, events, metrics
operator	viewer	Manage devices, trigger rollouts, open terminals
tenant_admin (Admin)	operator	Manage users, apps, network subnets, alert rules
super_admin	tenant_admin	Platform-wide: manage organizations, quotas, all users

Note: Owner is organization ownership state, not an organization-defined role. The owner is bound to the fixed Admin role and ownership can change only through the ownership-transfer operation. super_admin is a platform-level flag set directly in the users table. The three assignable organization roles are fixed by the platform.

User List

Navigate to Users to see everyone with access to the current organization.

Columns: Username, Display Name, Email, Role, Last Login.

Filter by Role.

Inviting a User

Organization access is invitation-only. To invite an existing user or an email address that has not registered yet:

1. Click Invite User (if visible for your role).
2. Enter the email address.
3. Weave reserves one seat while the invitation is pending and sends the invitation link.
4. The invitee redeems the invitation, signs in or completes registration, and joins the organization.

An expired or revoked invitation releases its reserved seat.

Changing a User's Role

1. Click the ⋮ menu on a user row → Change Role.
2. Select the new role.
3. Click Save.

Role changes take effect on the user's next API request.

Suspending / Activating a User

• Suspend — prevents the user from logging in without deleting their account.
• Activate — re-enables a suspended account.

Click the ⋮ menu → Suspend or Activate.

Built-in Roles

Each organization can assign only the three built-in roles: tenant_admin (Admin), operator (Operator), and viewer (Viewer). The owner is determined by organization ownership. An organization administrator can change another user's assignable role, but cannot create, modify, or delete roles or change role permissions. Role permissions are maintained by the platform release.

API Key Roles

API keys are assigned a role at creation time. The key inherits that role's permissions in the current organization. See Settings → API Keys.