Org members and roles
Invite, change role, remove. Org roles vs. workspace roles.
Managing the people in your organisation has two layers: the organisation role (controls billing, member directory, and workspace creation) and the workspace roles (control day-to-day work inside each workspace). This page is for org admins doing the first; workspace-level membership is covered in Workspaces and Roles and permissions.
Organisation roles
Three built-in org roles. Every member has exactly one.
- Owner
- Everything: view and manage billing, update the org, invite and remove members, change member roles, create workspaces, delete the org. Typically one person, the buyer or programme lead.
- Admin
- Everything an Owner can do except managing billing and deleting the org (an Admin can still view billing). The day-to-day administrative role.
- Member
- Read-only at the org level: sees the org, the other members, the workspace list and storage usage. Actually doing work happens at the workspace level via workspace roles.
An org Owner or Admin automatically holds every workspace permission in every workspace of the organisation, whether or not they were added as a workspace member. Only org Members need an explicit workspace membership; without one they have no access to that workspace at all.
Inviting members
- Settings → Organizations → your org → Members
Click Invite member.
- Enter one person
Invitations are one at a time: type an email address, or pick an existing Dalea user. There is no multi-address paste and no batch.
- Pick the org role
Default is Member. Bump to Admin for IT staff and ops, but remember an Admin reaches into every workspace. You can never grant an org role above your own.
- Optional: pre-assign workspace memberships
The composer lists the workspaces you may invite into, each with a role picker, so the person lands with the right access already granted. Nothing is selected by default.
- Send
The invitee gets an accept link. The invite expires in 48 hours. A Pending Invitations list sits above the members table, where an Owner or Admin can cancel one; to give someone a fresh window, invite them again.
Changing a member's role
Same Members page, use the role dropdown next to a name. The only assignable values are Admin and Member; changes apply immediately and are audited.
Two things the API refuses outright: changing your own role, and changing an Owner's role. There is no ownership transfer, and the Owner role cannot be handed out from this page. The only way a second Owner comes into existence is inviting a brand-new member as Owner, which an Owner can do; the incumbent stays an Owner either way.
Removing a member
Same page, click Remove on the member's row and record the reason. This:
- Deletes their workspace memberships across the whole org.
- Deletes the org membership itself. This is a hard delete: there is no recovery window, and re-adding the person means inviting them again.
- Requires a reason for change (EU GMP Annex 11) and is logged with operator, timestamp and that reason.
Their access dies at the next authorisation check, since the membership row is gone. Existing session rows are not deleted: they expire on their own 7-day schedule, and a cookie-cached session can stay usable for up to five minutes.
It does not delete their Dalea account; they can still sign in and access other orgs they belong to.
For sensitive offboarding (a terminated employee), pair this with rotating any shared API keys they had access to and exporting the audit trail for the workspaces they worked in. See Audit logging.
Workspace memberships at scale
Most teams find this more useful than micromanaging org roles:
- Make a few people org Admins — typically the IT lead and the ops manager.
- Add everyone else as org Members.
- Then run workspace memberships explicitly per workspace.
Tips
At least two people should be Owner of any org you depend on: if your sole Owner leaves the company, you need someone else with the keys. Decide this when you invite them, because the Owner role can only be set on a new invitation. An existing Admin cannot be promoted, and an Owner cannot be demoted.
Sign up business members with their work email, not their personal Gmail. When someone leaves, IT can reclaim the work email; they can't reclaim a personal one. Sessions tied to personal emails outlive employment.