Members, roles, and permissions
Grant the minimum access needed across the organization, projects, reviews, and external connections.
Access in Neatlogs has several layers. Organization membership, project access, reviewer assignment, and external connection permissions are related but not interchangeable.
| Boundary | Controls |
|---|---|
| Organization membership | Organization role, membership administration, and the default access to every project |
| Project access | Visibility and actions within one telemetry project |
| Reviewer assignment | Which Eval questions a person is asked to review |
| Service account | An automation identity with explicit project bindings and token scopes |
| Organization integration | Shared connections such as Slack, GitHub, Linear, or Jira |
| Personal tool connection | External context a specific user can expose to an allowed AI workflow |
| External provider permission | Repositories, channels, or projects the connected account can access |
Understand the roles
Every person in an organization has one organization role. That role sets their default role on every project in the organization.
| Organization role | What it allows | Default project role |
|---|---|---|
| Owner | Everything an admin can do, plus billing ownership. Only the owner can transfer ownership; it is never granted by invitation. | Project admin, cannot be lowered |
| Admin | Invite, remove, and change the role of members (except the owner); manage project access overrides and service accounts; view organization Activity; archive and delete projects | Project admin, cannot be lowered |
| Member | View the member list and create projects | Project member, can be raised or lowered per project |
| Guest | View and complete assigned evals only | No access until an owner or admin grants project viewer access on a specific project |
Project roles control what a person can do inside one project:
| Project role | Typical actions |
|---|---|
| Admin (project admin) | Everything a project member can do, plus project administration such as saving the PII redaction policy |
| Member (project member) | Work with project data, Evals, prompts, and alerts; rename the project; configure project AI provider keys |
| Viewer (project viewer) | Read-only access, plus comments and assigned Eval responses |
When a page shows a view-only notice, the action needs a higher role. Ask a project admin, or an organization owner or admin.
Add a teammate safely
Before inviting someone, decide what they need to do:
- inspect traces in one project;
- review assigned Eval questions;
- configure organization integrations;
- manage provider credentials;
- investigate incidents;
- dispatch work to a repository or tracker.
Then grant the narrowest organization role and project overrides that support those tasks.
Organization membership
Use Settings → Organization → Members to see the organization's people and pending invitations. Anyone in the organization can view the list. Only organization owners and admins see Invite member and can remove people or change roles; ask one of them if you need a change.
To invite someone, select Invite member, enter their email, choose Admin, Member, or Guest, and select Send invitation. Pending invitations appear on the Invitations tab, where owners and admins can choose Resend invitation or Revoke invitation.
Membership alone does not imply the same access to every project. Members inherit project access, and project overrides can raise or lower it; guests get nothing until an override grants it.
Project access
Only organization owners and admins can view and change project access. Open Settings → Project → Access with the intended project selected in the workspace switcher. Other members see their own project role and a notice instead of the roster; ask an organization owner or admin to grant or change access.
The page lists only overrides: people whose access in this project differs from what their organization role gives them. To add one, select Add override, choose the person, and pick Admin, Member, or Viewer. Guests can only be given Viewer. Use Reset to inherited to remove an override. Owners and admins always keep project administration, and organization members cannot currently be given no access to a project.
Confirm the selected project before changing access.
Reviewer and guest access
Eval questions can be assigned to teammates per question. This allows a policy specialist to review policy correctness without owning every Eval configuration decision.
A guest reviewer can complete assigned evals through a scoped review link. That link is bound to the assigned review and can expire; it does not grant general dashboard or project access.
Do not send an ordinary project link and assume it behaves as a guest grant.
Give automation its own identity
Use Settings → Organization → Service accounts for CI jobs, scripts, and agents that call the Public API or CLI. A service account is bound to specific projects with a role, and its tokens carry scopes and an expiry. Only organization owners and admins can create service accounts or change their access. See Public API authentication and CLI automation.
Understand connection permissions
Shared organization integrations and personal AI-tool connections solve different problems.
| Connection | Where | Typical purpose | Who manages it |
|---|---|---|---|
| Organization integration | Settings → Organization → Integrations | Slack alert delivery and collaboration, Discord, Linear, Jira, Asana, or Basecamp tickets, Notion, and the GitHub App | Any organization member can connect Slack, Linear, Jira, Notion, Asana, or Basecamp. Only owners and admins can connect Discord or install the GitHub App. |
| Trace import | Settings → Project → Trace imports | Read traces from an external observability platform | Owners and admins manage the shared source connection; project admins start and control import jobs |
| Tools and MCP connection | Settings → Account → Tools & MCP | Your own connected apps and MCP servers, used with your permissions by AI workflows | Each user, for themselves |
| AI provider key | Settings → Project → AI Providers | Authorize model use for AI features | Project members and admins |
Slack and Discord are shared organization connections. Credentials for the other organization integrations belong to the person who connected them.
The external provider also enforces its own access. A GitHub installation limited to two repositories cannot expose a third repository merely because the Neatlogs user is an administrator.
Keep permission boundaries clear
- Reading a trace does not grant permission to change a detection.
- Mentioning someone does not grant project access.
- Accepting a fix does not grant repository or deployment permission.
- Connecting a tool does not make it available to every evaluator.
- Slack delivery does not grant an AI agent channel-history access.
- A provider key does not authorize telemetry ingestion.
- Project IDs supplied by a client do not replace authenticated access checks.
Review access over time
Review membership and connections when:
- someone changes teams or leaves;
- a project begins capturing more sensitive data;
- an evaluator gains external tools;
- an integration owner changes;
- a repository, Slack workspace, or tracker is reorganized;
- a credential is rotated or revoked.
Remove the Neatlogs grant and revoke external access where applicable. Those may be separate actions.
Understand activity records
Organization owners and admins can open Settings → Organization → Activity. It currently records project archive, restore, and deletion only; other organization changes are not included yet. Product activity, entity history, and integration histories provide other useful provenance.
Do not treat this activity as a comprehensive compliance audit log.
Frequently asked questions
Why can a teammate see the organization but not a project?
Organization membership and project access are separate. A guest needs a project override, and an override can also restrict a member to Viewer.
Why does the project access page not show the roster?
Only organization owners and admins can view and change project access. Ask one of them to make the change.
Can a guest open other traces?
A guest review link exposes only its assigned review. Ordinary dashboard access still requires a project override from an owner or admin.
Who can configure integrations?
It depends on the connection type. See Understand connection permissions. Ask an organization owner or admin for Discord, the GitHub App, or a trace-import source connection.
Does removing project access revoke OAuth access?
Not necessarily. Remove the Neatlogs grant and disconnect or revoke the external app when appropriate.
Does connecting a tool make it available to all investigations?
Your own Tools & MCP connections are available to the AI assistants you use, with your permissions; they are not shared with teammates. An AI evaluator can use a tool only when the tool is granted to that evaluator.
Next step
Projects, workflows, and environments
Organize telemetry so access, credentials, search, and production comparisons remain predictable.
Integrations
Connect Slack, Discord, Linear, Jira, GitHub, coding agents, trace imports, and webhooks so alerts, incidents, and fixes reach the tools your team already uses.