> ## Documentation Index
> Fetch the complete documentation index at: https://docs.masterskills.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Organizations & roles

> Org-only namespaces, three roles, and invite links that onboard a team in minutes.

Everything in MasterSkills belongs to an **organization**: skills, kits, members, devices, and the audit log. There are no personal namespaces — on first sign-in you either create an organization or join one through an invite. You can belong to several organizations; searches and installs span all of your memberships.

## Roles

|                                     | `member` | `admin` | `owner` |
| ----------------------------------- | -------- | ------- | ------- |
| Search, install, update skills      | ✓        | ✓       | ✓       |
| **Publish skills**                  | ✓        | ✓       | ✓       |
| Create and curate kits              | ✓        | ✓       | ✓       |
| Manage own devices                  | ✓        | ✓       | ✓       |
| See the member list                 | ✓        | ✓       | ✓       |
| Invite links, approve join requests | —        | ✓       | ✓       |
| Change roles, remove members        | —        | ✓       | ✓       |
| Billing                             | —        | ✓       | ✓       |
| Archive kits, view audit log        | —        | ✓       | ✓       |
| Transfer or delete the organization | —        | —       | ✓       |

Each organization has exactly **one owner** — the person who created it. Owners differ from admins only in transfer and deletion rights; day-to-day administration (members, roles, invites, billing) is admin work, and there can be several admins.

Members are deliberately capable: **publishing is a member right**, because the people writing skills are rarely the people running the org. Members can leave at any time; an owner must transfer ownership first.

Removing a member (or a member leaving) revokes their devices for that organization.

## Invite links

One shareable link onboards the team. It works in three modes:

| Mode                                     | Behavior                                                                                                                                             |
| ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Domain-restricted** (e.g. `@acme.com`) | Matching emails join instantly — the domain match is the verification. Non-matching emails are not rejected; they fall through to the pending queue. |
| **Open** (`*`)                           | Anyone with the link joins instantly.                                                                                                                |
| **No domain**                            | Every join files a pending request; an admin approves it on the members page.                                                                        |

Admin approval is always the base flow — the domain is a bypass for the common case. A pending membership carries **no access at all**: no catalog, no installs, nothing, until approved.

Practical details:

* The domain can be updated **in place** without changing the link.
* **Rotating** the link is a separate, deliberate action — the old link dies instantly.
* Joins are rate-limited to 50 per organization per day.

See [Onboard your team](/guides/onboard-your-team) for the admin walkthrough.