Organizations and roles
Where organizations and people are managed, what each role can do, and how removing somebody works.
CodeBook keeps no user table of its own. Organizations, their members and their roles live in the Bookbag account service and are read by every product in the suite.
Why it works that way
Three products with three copies of "who works here" is three chances for them to disagree — and the disagreement that matters is the one where somebody who left still has access somewhere.
One source, read by everybody, means removing a person removes them everywhere at the same moment.
The roles
| Role | Can |
|---|---|
| Owner | Everything, including transferring ownership. Exactly one per organization, and it is transferred rather than assigned. |
| Admin | Manage members, workspaces and settings. |
| Member | Work: factories, workflows, cards, agents, stations. |
| Viewer | Read. |
Inside CodeBook, what you can do follows from this role and from the workspace you are in.
Managing people
Members are added, removed and re-roled in the Bookbag account service. Members & access on the organization's home in CodeBook opens that page. Adding somebody by an email address that has no account yet creates a pending membership and sends an invitation; the membership attaches itself to their account the first time it is looked at after they register.
CodeBook has no member-management pages or endpoints of its own. The organization's members, roles, invitations, ownership and audit log are all on SSO's organization page.
What lives at SSO, and what stays in CodeBook
CodeBook used to carry its own copies of several organization pages. They are gone; each is managed at Bookbag SSO for every product at once:
| Managed at SSO | How you reach it from CodeBook |
|---|---|
| Creating organizations | Manage organizations in the organization switcher |
| Members, roles, invitations | Members & access on the organization's home |
| The organization's chat | The chat bubble in the corner of the app; conversations are stored at SSO |
| Files and storage | Storage use is shown under the organization switcher on organization pages |
| AI: managed models or the organization's own keys, and the token allowance | The allowance meter in the account menu, which links to SSO; see model providers |
What stays in CodeBook is what is CodeBook's: the organization's home (its workspaces and the concierge), Managed service and the Provider console (managed service mode), and the organization's product settings (Settings, the last entry in the sidebar's CodeBook group). Owners and administrators can rename the organization from its home; the rename and a deletion are forwarded to SSO rather than stored here. See finding your way around.
Per-product roles
Separately from the organization role, an account carries a role per product: member or platform admin. That is what decides whether somebody sees CodeBook's admin area, and it is set in the same place.
Sign-out
Signing out ends the session at the account service, not only in CodeBook. A local sign-out alone would bounce through the login page, find the shared session alive and sign you straight back in — so sign-out is central by design.
One theme
Light or dark is an account preference, stored centrally. A choice made in one Bookbag product is what the next one opens in.