User management combines organization membership with explicit Arcane access assignments. Membership determines whether a person belongs to the organization. Organization permissions, application assignments, and optional access expiry determine what that person can do. This separation allows an organization to keep membership administration and application authorization distinct while presenting them in one team view.
User-management actions require the admins:manage_application_administrators permission. Every read and write operation is limited to the organization in the authenticated session.

​
Access model

Access to one application does not provide access to every application in the organization unless broader permissions have been explicitly granted.

​
Roles

The current invitation model accepts two member roles: An External Auditor uses the application-auditor role with an external organization reference and time-limited access. External access should always be scoped to the applications and permissions required for the review. The organization owner has a separate set of organization-wide management permissions and is not selected as an invitation role.

​
Invite a member

1

Open Organization Access

Open the organization workspace and select Team.
2

Start an invitation

Select Add Member.
3

Enter the member identity

Provide the member’s full name and work email address.
4

Select a role

Choose Application Administrator or Application Auditor. The role is applied when the invitation is created.
5

Define the application scope

Select the applications the member needs and configure the permission groups for each assignment.
6

Set the access period

Use permanent access for continuing internal responsibilities or set an expiry timestamp for temporary access. External reviewers should receive time-limited access.
7

Send the invitation

Select Send Invite. The membership remains Pending until the invitation is accepted.
The platform records the invitation, role, application assignments, permission groups, and access expiry. The invitation is also recorded in the activity history.

​
Permission groups

Permissions are grouped by responsibility and stored separately for each application assignment. Organization-level owner permissions are separate from application permission groups. They can provide the ability to:
  • create and read applications;
  • view organization activity;
  • manage application administrators;
  • manage API keys;
  • create, list, and download organization reports.
Assign organization-level owner permissions only when the member needs to administer the organization itself. Application work should normally use application-scoped assignments.

​
Review the team

The organization team list combines membership status with Arcane access metadata. It includes:
  • member name, email, organization, and role;
  • membership and access status;
  • organization-wide access indicator;
  • assigned applications;
  • permission groups;
  • access expiry and last recorded activity.
The list is paginated and can be filtered by application and access status. The team overview also reports total, active, pending, external, expiring-soon, and suspended member counts.

​
Access statuses

​
Review and change access

Open a member to review organization-level owner permissions and every application assignment. For an existing member, an authorized administrator can:
  • update organization-level owner permissions;
  • add or update permissions for one application;
  • remove access to one application without changing other assignments;
  • update the same permission groups across existing application assignments;
  • extend access that is already time-limited;
  • suspend or reactivate the organization membership.
Permission updates do not change the member’s role. The role is assigned at invitation time, and the current management flow does not expose a separate role-change operation.
Only time-limited access can be extended. Permanent access has no expiry to extend.

​
Suspend or reactivate a member

Suspension deactivates the organization membership and blocks access to the organization. It is broader than removing a single application assignment. The platform prevents an administrator from suspending their own membership. Use Reactivate Access to restore an inactive membership when access should resume. The platform does not expose a permanent member-deletion operation. Use suspension for organization-wide access removal and remove individual application assignments when only a narrower scope must be revoked.

​
Audit history

The platform records the following user-management events:
  • member or external auditor invited;
  • member suspended or reactivated;
  • time-limited access extended;
  • organization or application permissions updated.
These events provide an administrative record of who changed access and which member was affected.

​
Next steps

Application management

Create application boundaries before assigning application-scoped access.