Organization: workspaces and roles

Personal and team workspaces

Everyone has a Personal workspace: its settings, API keys and chats are private to you. A team workspace (an organization) adds shared members, pooled credits, organization billing and the Organization group of settings.

1. Step 101

   Create an organization

   Open Settings → Organization and press New organization (or Create organization in the empty state). Give it a name and a slug. Partners’ clients get their workspace from a license code at /redeem instead.
2. Step 202

   Put it on an organization plan

   Team, Business and Enterprise are organization plans with seat limits; personal plans are one seat. See Plans and billing.
3. Step 303

   Switch workspaces

   Open the user menu (your avatar). Each organization is a row, then Personal; the active one is checked. The Organization settings cards switch too. Every request Akili makes is scoped to the active workspace.

Members and invitations

Invite by email

In Settings → Organization press Invite members, paste addresses separated by commas or new lines (up to 50 at a time), pick Admin or Member, and send. Invitations expire after 48 hours. The Pending invitations list shows each one as pending, expiring soon, delivery failed or expired, with Resend (five-minute cooldown), Renew & resend, Edit email & resend and revoke.

Invite codes

Generate invite code creates a shareable code with a role (owner, admin or member), Max uses (1–1,000) and Expires in (days) (1–365; the defaults are one use and 14 days). Codes can be revoked or regenerated. A warning appears when the code’s uses exceed the free seats, because redemption is not blocked by the seat limit.

Seats and removal

Email invitations stop at the plan’s seat limit minus current members. Removing a member deletes their role grants and membership and is recorded in the audit log; the member keeps their own Personal workspace.

Roles

Settings → Roles (?settings=roles) lists the built-in roles and any custom ones.

• Custom roles have a name, an optional description and a non-empty set of permissions chosen from the catalog (members, billing, credits, usage, audit, roles, settings, SSO, SCIM, GDPR, webchat, flows, agent credentials, analytics, BI, providers, models, routing and the marketplace resources). Create, duplicate, edit or delete them with the roles-manage permission.
• Assigning a role needs the assign-role permission and is logged. You cannot change your own role.
• Invite codes and invitations carry the role the new member starts with; a code can also attach a Marketplace role.

Policies

The Policies list in Settings → Organization is where owners and admins decide what members may do. Disabled policies override individual member settings, and every change is audited.

A response cache (one-hour, organization-scoped) and Studio and social publishing options live in the same list.

Org instructions

Settings → Org Instructions holds up to 3,000 characters of organization-wide guidance with an active switch. Akili’s social writing assist and AI drafts read the opening of it as brand context. Owners and admins edit it; changes are audited and cached for up to 60 seconds.

Bring your own provider keys

Settings → Provider Keys (?settings=org-providers) lets an organization connect its own accounts for OpenAI, Azure OpenAI, Anthropic, Google, Mistral, xAI, Perplexity and OpenRouter, plus Ollama and other adapters where your deployment offers them.

1. Step 101

   Enter the key

   Each provider has its own fields: an API key, and for Azure the resource name. Keys are stored encrypted.
2. Step 202

   Test connection

   Runs against the values you typed before anything is saved, so a wrong key never replaces a working one.
3. Step 303

   Save

   Saving needs the providers-write permission. Akili then discovers that provider's model catalog for everyone in the workspace.

• Resolution order. A model call uses the organization’s key when one exists, otherwise the platform’s. Personal provider keys are retired.
• Metering does not change. Calls through your key still spend credits at the model’s rate; see Credits and usage.
• Member BYOK can be switched off by policy so that only organization keys are used.

Webhooks

Settings → Webhooks sends events to an HTTPS endpoint of yours. Pick up to 20 events per hook, or none to receive all: social post published, failed, awaiting approval, metrics updated, channel needs reconnecting; flow run completed or failed; flow notify; and a test event.

• Signing. The secret (whsec_…) is shown once; later only its last four characters. Each delivery carries X-Akili-Signature: t=<unix>,v1=<HMAC-SHA256 of "t.body"> plus event, delivery and attempt headers. Verify within a 300-second tolerance.
• Retries. Five attempts with exponential backoff starting at ten seconds. A hook pauses itself after 20 consecutive failures; edit it to resume.
• Actions. Create, edit, rotate the secret, send a test, delete. Reading needs settings-read; changes need settings-write.

Analytics, audit log and agent trust

• Analytics (Settings → Analytics, owners and admins): daily, weekly and monthly active members, stickiness, median session, who is active right now, feature adoption and retention by signup week. Credit figures are in Usage & Credits.
• Audit log (Business and Enterprise): policy, profile, domain, instruction, webhook, role and membership changes are written with who did what and when. Members with audit read permission read it in Settings → Organization → Audit log (filter by action, actor, resource type and date, open an entry's stored details, export the filtered rows as CSV) or through the API (GET org-settings/audit, 50 entries a page; audit/export.csv for the export).
• Agent trust (Settings → Agent trust): signed receipts for every committing action an agent took under a mandate, or that a member approved or denied, kept seven years and verifiable offline; an export (receipts plus key snapshots, up to a year) whose link lasts an hour; and the list of agent credentials with a recertification queue to keep or revoke each one.

Good to know

• Requests name the workspace. API calls carry x-akili-org-id; a workspace you are not a member of answers 403.
• Owners cannot be removed through SCIM if they are the last owner. See SSO and domains.
• Policies are read by every member but only changed with settings-write; reading them still works while an SSO or MFA requirement blocks the rest of the workspace, so you can always see why.
• Invite code over seats? The code works, and the workspace goes over its plan; email invitations are the seat-checked path.