--- id: people-and-roles title: People and roles sidebar_label: People and roles --- Two separate things live here: who is in your **account**, and who has access to each **instance**. ## Account members **People** lists everyone in the account. | Role | Can | | -------- | ----------------------------------------------- | | `owner` | Everything, including billing | | `admin` | Invite, create instances, grant instance access | | `member` | Read | Owners and admins invite; billing is owner-only. ### Inviting someone 1. **People → Invite**. 2. Enter their email and pick a role. 3. They receive a link and set their own password at `/accept-invite`. :::info Why you cannot set their password An invited person cannot sign in at all until they set their own password. If you chose it for them, it would be a shared password to every instance they are later given access to. Their invitation link stays valid until they use it to set that password. ::: ### Removing someone Removing them from the account removes their portal access. It also removes their instance access immediately, and ends any session they have open. ## Cloud instance access Granting access to a **cloud** instance creates a real account inside that instance, marked as managed by Vantage HQ. ```mermaid flowchart LR P["Person in your Vantage HQ account"] -->|you grant access| U["Account inside the instance"] U --> I["They sign in at the instance,
like anyone else"] ``` They then sign in at the instance itself, and that keeps working whether or not Vantage HQ is reachable. Revoking removes the account outright, so access ends immediately. ### Granting access and roles On an instance record, **Members → Add**, choose the HQ account member and an instance role (`owner`, `admin`, `member`). One person gets one account per instance, so granting twice is refused rather than quietly creating a second. These roles are independant of HQ account roles.