vantage-docs/docs/hq/people-and-roles.md

id, title, sidebar_label

id	title	sidebar_label
people-and-roles	People and roles	People and roles

Two separate things live here: who is in your account, and who has access to each instance.

Account members

People lists everyone in the account.

Role	Can
owner	Everything, including billing
admin	Invite, create instances, grant instance access
member	Read

Owners and admins invite; billing is owner-only.

Inviting someone

1. People → Invite.
2. Enter their email and pick a role.
3. They receive a link and set their own password at /accept-invite.

:::info Why you cannot set their password An invited person cannot sign in at all until they set their own password. If you chose it for them, it would be a shared password to every instance they are later given access to.

Their invitation link stays valid until they use it to set that password. :::

Removing someone

Removing them from the account removes their portal access. See below for what happens to their instance access.

Instance access

Granting access to a cloud instance creates a real account inside that instance, marked as managed by Vantage HQ.

flowchart LR
    P["Person in your Vantage HQ account"] -->|you grant access| U["Account inside the instance"]
    U --> I["They sign in at the instance,<br/>like anyone else"]

They then sign in at the instance itself, and that keeps working whether or not Vantage HQ is reachable. Revoking removes the account outright, so access ends immediately.

Granting

On an instance record, Members → Add, choose an account member and an instance role (owner, admin, member).

One person gets one account per instance, so granting twice is refused rather than quietly creating a second.

Roles inside an instance

Independent of the account role. Someone can be an account member and an instance owner, or the reverse.

Revoking

Removes their access immediately, and ends any session they have open.

:::warning Self-hosted instances cannot be granted from HQ Vantage HQ cannot add or remove people in a self-hosted install. Manage them in the install itself, at Settings → Access. :::

Passwords

One Vantage HQ password covers you and every cloud instance you have been given access to. Change it in the portal and it changes everywhere, within about 15 minutes at worst if an instance is briefly unreachable.

Those people cannot change that password inside an instance, so there is only ever one place it is set.

:::warning HQ-managed users are read-only in the instance Changing the role of, or removing, someone managed by Vantage HQ has to be done from the portal. Inside the instance those rows are read-only, with a link back here. :::