Members & roles
Roles, invitations, and removal — managed from one Members surface.
Roles, invitations, and removal all live on the Members settings surface and are best understood together.
| Scope | |
|---|---|
| Who can do it | Owners and admins manage members; members cannot |
| Applies to | Cloud and self-hosted |
| Requirement | A team organization |
| Affects | A user's membership, and the organization's seat count |
Roles
Every member has exactly one role. There are no separate groups or teams.
| Role | Can do |
|---|---|
| Owner | Everything an admin can, plus promote or demote other owners. |
| Admin | Manage org settings, invite and remove members, change member roles between admin and member, install the GitHub App, configure SSO, and edit the agent policy. |
| Member | Use workspaces, repositories, and agents in the organization. Cannot change org settings, members, or policy. |
Verified invariants the API enforces:
- You cannot modify your own membership — not your role, not your removal.
- The last owner cannot be removed or demoted. An organization always keeps at least one owner.
- Only an owner can change another owner's role. Admins move people between admin and member; promoting to or demoting from owner is owner-only.
Self-hosted deployments add two lockout-prevention rules for the instance organization:
- A user whose email is listed in
ADMIN_EMAILScannot be demoted below admin while that email remains listed. - The last active instance admin cannot be removed or demoted.
Invitations
Invite from the Members pane by entering an email address. The role dropdown offers Member and Admin.
- Owner is not an invite option. An owner promotes someone to owner after they join, by changing their role.
- Invitations are email-specific. The join is scoped to the invited address; a person signing in with a different email cannot accept it.
- The copyable join URL is an entry point for the invited person, not a grant. Possessing the URL does not make someone a member — they still have to authenticate as the invited email.
- Pending-invitation row actions are Copy link and Revoke. There is no Resend action.
Removing a member
Removing a member changes their membership state and adjusts the organization's seat count.
Removal does not currently terminate that member's running sessions, revoke every credential they hold, or remove organization secrets already materialized into their sandboxes. If a departure needs to invalidate access immediately, rotate the relevant organization secrets yourself.
On Cloud, removed users are not silently reactivated. Bringing someone back
requires a fresh invitation. Self-hosted deployments are the exception: an email
on the operator's ADMIN_EMAILS list is reinstated as an instance admin at its
next login, so offboarding a listed user there also means removing them from
ADMIN_EMAILS.