# Members and roles

> The four roles in a LevelFour organization, what each one can do, and how to invite people, change a role or remove someone.

Source: https://docs.levelfour.ai/account/members-and-roles


Everyone in your LevelFour organization holds one of four roles. Viewers, members and admins read everything, and their role decides what they can change. An Access Manager manages who uses LevelFour and reads none of your data.

## Roles

| Role               | What it can do                                                                                                                                                                                |
| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Viewer**         | Reads every board, cost page, saving, commitment and statement. Changes nothing.                                                                                                              |
| **Member**         | Everything a viewer can do, plus preparing a saving and asking an admin to approve it, commenting on savings, and editing boards, tags, cost alerts and anomaly statuses.                     |
| **Admin**          | Everything a member can do, plus accepting and rejecting savings, approving a rollout someone else requested, renewing commitments, and managing members, API keys, integrations and billing. |
| **Access Manager** | Invites people, resends and revokes invitations, changes anyone's role and removes anyone, admins included. Sees no costs, savings or other data.                                             |

A rollout that a member requests waits for an admin to approve it, so no single member can apply a change to your cloud account alone. [Approvals and rollout](/savings-recommendations/approvals-and-rollout) walks through that flow.

> **Note**
>
> The dashboard hides or disables the controls a role cannot use, and LevelFour enforces the same rules on every request, so a hidden button is never the only thing standing in the way.

## Access Manager

Give this role to the team that handles access for your company, such as an IAM or IT team, when they shouldn't see what you spend. It covers all of access management and nothing else:

* An Access Manager signs in to **Users & Access** alone. Every other page, and any link to one, opens Users & Access instead.
* They can make anyone an admin, or another Access Manager. They can't change their own role.
* They can't sign in to the CLI, create API keys or connect an AI app, because each of those reads your data.
* LevelFour sends them no cost alerts, anomalies or savings emails, and mentioning them on a saving doesn't notify them.

The role limits one account. An Access Manager in a Slack channel LevelFour posts to reads those posts, and a second account with another role sees what that role allows.

## See who has access

In the dashboard sidebar, open **Settings**, then **Members**. The **Users & Access** page lists everyone in the organization with their role, their last activity and the date they joined.

Search by name, or narrow the list with **Filter by role**.

## Invite people

Admins and Access Managers can invite people from **Users & Access**.

### Open the invite dialog

Click **Invite people**.

### Add each person and their role

Enter an email address and pick the role they join with. Click **Add another** to invite up to ten people at once, each with their own role.

### Send

Click **Send invitations**. Each person gets an email with a link to join. Once they accept, they appear on the **Users** tab with the role you picked.

The **Invitations** tab lists the invitations nobody has accepted yet, with who sent each one and when. From there you can resend an invitation or revoke it. An invitation expires 30 days after you send it.

You can't invite your own address or someone already in the organization. If your organization signs in through your own identity provider, people can also join by signing in. [Enterprise SSO](/account/sso) covers how that works.

## Change a role

### Open the member's row

On **Settings > Members**, find the person. Only admins and Access Managers see the role control and the row actions.

### Pick the new role

Choose **Admin**, **Access Manager**, **Member** or **Viewer** from the role control on their row.

### Confirm

The dialog names the old and new role. Click **Change role**. The new access applies within a minute.

## Remove a member

Open the row's actions and click **Remove member**, then confirm. The person loses access within a minute, and LevelFour ends their CLI sign-ins and AI app connections as it removes them.

Moving someone to Access Manager also ends their CLI sign-ins and AI app connections, since the role reads no data.

## Limits on role changes

* LevelFour won't let you change your own role or remove yourself. Ask another admin or Access Manager.
* The last admin can't be demoted or removed. Make someone else an admin first.

## Next

* [Enterprise SSO (SAML)](/account/sso) signs your team in with your identity provider
* [API keys](/account/api-keys) are managed by admins, on the same Settings page
* [Approvals and rollout](/savings-recommendations/approvals-and-rollout) is where the member and admin roles meet