---
id: people-and-roles
title: People and roles
sidebar_label: People and roles
---

Two separate things live here: who is in your **account**, and who has access to
each **instance**.

## Account members

**People** lists everyone in the account.

| Role     | Can                                             |
| -------- | ----------------------------------------------- |
| `owner`  | Everything, including billing                   |
| `admin`  | Invite, create instances, grant instance access |
| `member` | Read                                            |

Owners and admins invite; billing is owner-only.

### Inviting someone

1. **People → Invite**.
2. Enter their email and pick a role.
3. They receive a link and set their own password at `/accept-invite`.

:::info Why you cannot set their password
An invited person cannot sign in at all until they set their own password. If
you chose it for them, it would be a shared password to every instance they are
later given access to.

Their invitation link stays valid until they use it to set that password.
:::

### Removing someone

Removing them from the account removes their portal access. See below for what
happens to their instance access.

## Instance access

Granting access to a **cloud** instance creates a real account inside that
instance, marked as managed by Vantage HQ.

```mermaid
flowchart LR
    P["Person in your Vantage HQ account"] -->|you grant access| U["Account inside the instance"]
    U --> I["They sign in at the instance,<br/>like anyone else"]
```

They then sign in at the instance itself, and that keeps working whether or not
Vantage HQ is reachable. Revoking removes the account outright, so access ends
immediately.

### Granting

On an instance record, **Members → Add**, choose an account member and an
instance role (`owner`, `admin`, `member`).

One person gets one account per instance, so granting twice is refused rather
than quietly creating a second.

### Roles inside an instance

Independent of the account role. Someone can be an account `member` and an
instance `owner`, or the reverse.

### Revoking

Removes their access immediately, and ends any session they have open.

:::warning Self-hosted instances cannot be granted from HQ
Vantage HQ cannot add or remove people in a self-hosted install. Manage them in
the install itself, at **Settings → Access**.
:::

## Passwords

One Vantage HQ password covers you and every cloud instance you have been given
access to. Change it in the portal and it changes everywhere, within about 15
minutes at worst if an instance is briefly unreachable.

Those people cannot change that password inside an instance, so there is only
ever one place it is set.

:::warning HQ-managed users are read-only in the instance
Changing the role of, or removing, someone managed by Vantage HQ has to be done
from the portal. Inside the instance those rows are read-only, with a link back
here.
:::