Team
Manage organization members and shared developer policy
The Team page has two views: Members for organization membership and personal controls, and Teams for policy shared by groups of developers.
Members
The Members view shows each person's role, assigned organization team, projects, and limits. Teams plan owners and admins can also compare cost, tokens, requests, and API-key counts for the selected period.
Each row has actions to:
- Open the member's details and usage
- Change their role and project access
- Set a personal API-key or spending budget
- Add personal IAM rules
- Remove them from the organization
Personal IAM rules apply to every key created by that member. A key can narrow those rules, but cannot expand access beyond them. See Member-level IAM rules for rule behavior.
Roles
| Role | Permissions |
|---|---|
| Owner | Full access, including team management, billing, and organization settings |
| Admin | Can manage members, projects, and API keys, but cannot change billing controls or modify owners |
| Project admin | Manages settings, guardrails, keys, and usage in assigned projects; cannot administer the organization |
| Developer | Creates and manages their own API keys and views their own usage in assigned projects |
Invite a member
Click Add Member, enter an email address, and choose a role. Project admins and developers require a Teams plan and at least one project grant. The invitation remains under Pending Invitations until it is accepted or revoked.
Use Project admin for someone who needs to manage a project's settings and all its API keys and usage. Use Manage access on an existing member to change their role or replace their project grants. Organization settings, billing controls, and membership remain restricted to organization administrators. See Project access for the complete permission model.
Pending invitations reserve a seat. The Members card shows the current seat count and plan limit, and Add Member is disabled when the limit is reached.
Organization teams
Open Teams to group developers under a shared project, IAM, and budget policy. One developer can belong to one organization team; other roles cannot be assigned. Promoting a Developer to Project admin clears their team assignment.
Creating teams and changing team policy requires a Teams plan. If the plan ends, existing policy remains enforced and can still be reviewed. Developers can be unassigned, and empty teams can be deleted.
Click Create team, give it a unique name, then click Open to configure it. The list shows the number of developers, project ceiling, and IAM rule count for every team.
Configure team policy
| Control | Behavior |
|---|---|
| Team identity | Names the team and can mark it as the organization's default team. Names are unique within the organization. |
| Project ceiling | Effective access is the intersection of the team list and each developer's personal grants. With no projects selected, user keys return 403. |
| Per-developer budget ceilings | Caps each developer's active keys, lifetime spend, and recurring spend. Personal and API-key limits may be stricter. |
| Developers | Assigns, moves, or unassigns Developers. A move replaces the previous team's policy immediately. |
| IAM policy | Adds shared model, provider, pricing, or IP rules. Member and API-key rules run afterward and can only narrow access. |
Unassigning a developer restores their personal project, IAM, and budget settings. Unassign every developer before deleting a team.
Default team
One team per organization can be marked as the default. Developers who join — by invite or direct add — are assigned to it automatically; explicit manual assignments always win. When enabling the default you can optionally assign every developer currently without a team in one step. Moving or removing the flag only changes future joins: current members keep their team.
Team, member, IAM, and budget changes are recorded in Audit Logs.
How is this guide?