Skip to main content
Your team in sureops is the set of people who can log in, view incidents, and take action — scoped by their role. This page describes managing your organization’s members (not a separate “Teams” sub-group feature — there’s no team sub-group surface in the app today). Admins and Owners manage members from Settings → Team.

​
Inviting a new member

1

Open Settings → Team

Navigate to Settings → Team. You will see a list of current members with their roles. Members who haven’t yet accepted their invite show an Invited badge; accepted (active) members show no status badge at all.
2

Click Invite member

Enter the person’s email address and select their initial role. See Roles & Capabilities to pick the right starting role.
Default to the least-privileged role that lets them do their job. You can always promote later — it’s harder to retroactively audit over-granting.
3

Send the invite

Click Send invite. The person receives an email with a link to create their account or log in. Their role is set the moment they accept and log in for the first time.The member appears in your team list with an Invited badge until they accept.

​
Changing a member’s role

1

Find the member

Go to Settings → Team and locate the member by name or email.
2

Click Edit

Click the Edit button next to their row. Select the new role from the dropdown.
3

Save

Click Save. The change is written and audited immediately, but it takes effect for the member at their next token refresh or next sign-in — not on their very next request. Role is a claim baked into their session token at issuance, so an already-signed-in member keeps acting under their old role until that token refreshes or they sign in again.
You cannot promote a member to Owner from the role editor — ownership is not transferable through role assignment. See Ownership below.
Role changes are audited immediately but are not instantly enforced against an already-signed-in member. Demoting a Commander to Responder does not immediately revoke their ability to approve HITL agent actions — if they are mid-session, they can keep approving until their token refreshes or they sign in again. Don’t rely on a role change alone to stop in-flight access; communicate changes to your team, and if you need to guarantee a compromised or misbehaving session is cut off right now, pair the demotion with your own incident response containment steps.

​
Removing a member

1

Find the member

Go to Settings → Team and locate the member.
2

Click Remove

Click the trash icon next to their row. Confirm the removal in the dialog.
3

Membership deleted

The member’s organization membership row is deleted immediately and the removal is audited. Their historical contributions (incident comments, approvals, audit log entries) are preserved — removal does not delete history.This does not immediately cut off an already-signed-in member: access is checked against a claim in their session token, not against a live database lookup on every request, so a removed member’s existing session keeps working until their token next refreshes or they sign in again (at which point re-issuing their session fails, since their membership is gone). If you need a compromised or misbehaving member cut off immediately rather than at their next token refresh, removal alone isn’t enough — pair it with your own incident response containment steps.
Removal also kicks off best-effort cleanup of any external access the member had through your connected integrations — for example, revoking their GitHub collaborator access or Slack workspace access where sureops provisioned it. This runs asynchronously after the membership row is gone, so a slow or partially-failed external cleanup step never blocks or reverses the membership deletion itself. By the time a cleanup step fails, the member’s row is already gone from the list above — so the retry surface isn’t the Remove flow itself. Instead, a separate Access cleanup required card appears at the bottom of Settings → Team, listing each failed cleanup job with a per-member Retry button.
Removing a member does not delete their account, and it does not revoke your organization’s API keys — API keys are scoped to the organization, not to an individual member, and are untouched by a member removal. If you re-invite the same email address later, they can rejoin with a new role assignment.

​
Pending invites

Members who have been invited but haven’t accepted appear with an Invited badge in the team list. You can resend the invite — this sends a fresh invite (or account-recovery) link to the same address. There is no separate “cancel invite” action; to withdraw an invite before it’s accepted, remove the member row the same way you’d remove an active member. Invited members cannot log in until they accept.

​
Ownership

Every organization has exactly one Owner. sureops does not currently offer a self-service way to transfer ownership to another member — the role editor is deliberately structured so no role change can promote someone to Owner. If your Owner is leaving the organization or you need to change who holds that role, contact sureops support before they lose access; support can walk you through a verified ownership change.

​
Audit log

Every team management action — invite, role change, removal — writes an audit log entry with the actor, target, old role, new role, and timestamp. There is no in-app audit log viewer today; Admins and Owners can retrieve it via the API (GET /api/v1/audit-logs) or by asking sureops support for a report.

​
Frequently asked questions

How many members can I have? Your plan has a hard member cap: 10 on Free, 25 on Starter, 100 on Growth, and unlimited on Enterprise. Inviting past your cap returns an error — contact sureops support if you need more seats on your current plan. See Pricing & tiers for the full comparison. Can I have multiple Owners? No. sureops enforces exactly one Owner per organization at all times. This keeps accountability legible and prevents split-authority scenarios. Can I see who made a role change? Yes — every change is in the audit log with the actor’s identity, the target member, and the exact timestamp. What happens to a removed member’s API keys? Nothing — API keys are organization-scoped, not member-scoped, so removing a member doesn’t touch them. What does happen: their sureops membership is deleted immediately, and sureops best-effort revokes any external access (GitHub, Slack) it had provisioned on their behalf. See Removing a member above.