Privacy & Security
Members and roles
The four roles in a LevelFour organization, what each one can do, and how to invite people, change a role or remove someone.
Everyone in your LevelFour organization holds one of four roles. Viewers, members and admins read everything, and their role decides what they can change. An Access Manager manages who uses LevelFour and reads none of your data.
Roles
| Role | What it can do |
|---|---|
| Viewer | Reads every board, cost page, saving, commitment and statement. Changes nothing. |
| Member | Everything a viewer can do, plus preparing a saving and asking an admin to approve it, commenting on savings, and editing boards, tags, cost alerts and anomaly statuses. |
| Admin | Everything a member can do, plus accepting and rejecting savings, approving a rollout someone else requested, renewing commitments, and managing members, API keys, integrations and billing. |
| Access Manager | Invites people, resends and revokes invitations, changes anyone's role and removes anyone, admins included. Sees no costs, savings or other data. |
A rollout that a member requests waits for an admin to approve it, so no single member can apply a change to your cloud account alone. Approvals and rollout walks through that flow.
Access Manager
Give this role to the team that handles access for your company, such as an IAM or IT team, when they shouldn't see what you spend. It covers all of access management and nothing else:
- An Access Manager signs in to Users & Access alone. Every other page, and any link to one, opens Users & Access instead.
- They can make anyone an admin, or another Access Manager. They can't change their own role.
- They can't sign in to the CLI, create API keys or connect an AI app, because each of those reads your data.
- LevelFour sends them no cost alerts, anomalies or savings emails, and mentioning them on a saving doesn't notify them.
The role limits one account. An Access Manager in a Slack channel LevelFour posts to reads those posts, and a second account with another role sees what that role allows.
See who has access
In the dashboard sidebar, open Settings, then Members. The Users & Access page lists everyone in the organization with their role, their last activity and the date they joined.
Search by name, or narrow the list with Filter by role.
Invite people
Admins and Access Managers can invite people from Users & Access.
Open the invite dialog
Click Invite people.
Add each person and their role
Enter an email address and pick the role they join with. Click Add another to invite up to ten people at once, each with their own role.
Send
Click Send invitations. Each person gets an email with a link to join. Once they accept, they appear on the Users tab with the role you picked.
The Invitations tab lists the invitations nobody has accepted yet, with who sent each one and when. From there you can resend an invitation or revoke it. An invitation expires 30 days after you send it.
You can't invite your own address or someone already in the organization. If your organization signs in through your own identity provider, people can also join by signing in. Enterprise SSO covers how that works.
Change a role
Open the member's row
On Settings > Members, find the person. Only admins and Access Managers see the role control and the row actions.
Pick the new role
Choose Admin, Access Manager, Member or Viewer from the role control on their row.
Confirm
The dialog names the old and new role. Click Change role. The new access applies within a minute.
Remove a member
Open the row's actions and click Remove member, then confirm. The person loses access within a minute, and LevelFour ends their CLI sign-ins and AI app connections as it removes them.
Moving someone to Access Manager also ends their CLI sign-ins and AI app connections, since the role reads no data.
Limits on role changes
- LevelFour won't let you change your own role or remove yourself. Ask another admin or Access Manager.
- The last admin can't be demoted or removed. Make someone else an admin first.
Next
- Enterprise SSO (SAML) signs your team in with your identity provider
- API keys are managed by admins, on the same Settings page
- Approvals and rollout is where the member and admin roles meet
Security overview
How LevelFour connects to your accounts, protects your data and uses AI, and how to request a security review or report a vulnerability.
Enterprise SSO (SAML)
Sign your team in with your own identity provider over SAML 2.0: the values you exchange with LevelFour, the attributes your IdP must send, and how to set it up in Google Workspace.