Organizations, members and roles
What an organization holds, inviting people, the Owner, Admin, Member and Viewer roles, custom roles with fine-grained permissions, removing members and deleting an organization.
An organization is your team's account on Sovaria. It owns projects, holds the plan and the invoice, and lists the people who may work on its projects. Everyone who uses the console belongs to at least one organization.
Create an organization
You get one when you sign up. Create more from the organization switcher at the top left (New organization) — for example one per company or client. Each has its own plan and billing; projects can't share an organization's plan with another.
Built-in roles
| Role | Can | Can't |
|---|---|---|
| Owner | Everything, including billing, API keys, project settings, members and deleting the organization. Only an owner can make someone an owner or remove one. | — |
| Admin | Everything an owner can, except granting or taking away the owner role. | Make or remove owners. |
| Member | Build and run everything: tables and SQL, storage, functions, auth users, realtime, policies, secrets, logs, Sovariq. | Change billing, manage API keys or change project settings. |
| Viewer | See everything (tables, files, functions, settings, logs, billing) and ask Sovariq questions. | Change anything. |
Only owners and admins can create projects, invite or remove members and delete projects. Every console request is checked on the server against the member's permissions — a URL alone never grants access.
Custom roles
Under Organization › Roles, owners and admins can create up to 50 custom roles from the permissions below, and assign them to a member for the whole organization or for one project. A member's permissions are their built-in role's plus every custom role assigned to them.
| Area | Permissions |
|---|---|
| Database | database.read (view tables, rows, schemas) · database.write (change rows, run SQL, change schemas) · database.admin (backups, restore, compute, database settings) |
| Storage | storage.read · storage.write (upload, move, delete files) · storage.admin (buckets and storage policies) |
| Functions | functions.read (code and logs) · functions.invoke (run from the console) · functions.deploy (create, deploy, roll back, delete) |
| Authentication | auth.read · auth.manage (app users, providers, app roles, auth settings) |
| Realtime | realtime.read · realtime.manage |
| Policies | policies.read · policies.write |
| Secrets and keys | secrets.manage (project secrets and environment variables) · keys.read · keys.manage (create, rotate, revoke API keys) |
| Observability | logs.read (logs, metrics, traces, audit trail) |
| Project | settings.manage (project settings, custom domains, webhooks, integrations) |
| Billing | billing.read · billing.manage (plan, payment method, add-ons) |
| Sovariq | ai.use (ask, read-only) · ai.apply (let Sovariq make changes after you confirm) |
An organization can also narrow what Sovariq may do when it acts for a member (AI permissions); that can only remove permissions, never add them.
Invite people
Open Organization › Team
Choose Invite, enter an email and a role.
They get an email
The invitation link works for 7 days. Inviting the same email again sends a fresh link.
They accept
They sign in (or sign up) with that email address and verify it, then accept. Nobody is added to an organization without accepting.
await sovaria.api.org.createOrgInvite({ email: 'ada@example.com', role: 'MEMBER' })
const members = await sovaria.api.org.listOrgMembers()Routes and parameters: REST: organizations, members, keys and settings.
Change roles and remove members
- Owners and admins change roles and remove members under Team. You can't change your own role — ask another owner.
- Only an owner can give or take away the owner role, and an organization always keeps at least one owner (the last owner can't be demoted or removed).
- Removing someone takes effect within seconds: their console session and CLI token stop working for this organization.
When someone leaves
Remove them from Team
Their access ends at once.
Rotate what they could see
If they could read API keys or secrets (
keys.read,secrets.manage), rotate the service role key and any secrets they saw (Keys, tokens and credentials).Check the audit log
Review what they changed recently in Logs & Audit (Audit log).