Zum Hauptinhalt springen

Inviting Members

Build your team by inviting people to your ProBeya organization. Invited users receive an email with a link to join.

Sending Invitations​

  1. Navigate to Settings > Members.
  2. Click Invite Members.
  3. Enter the invitee's email address (must be a valid email format).
  4. Select one or more roles to assign. Available roles for assignment include all pharma roles except org_owner:
    • Administration: tenant_admin, site_admin
    • Operational Excellence: opex_coordinator, department_manager, team_leader
    • Project Management: project_manager, portfolio_manager, pmo_manager, sponsor
    • Quality: quality_manager
    • Access: team_member, guest
  5. Click Send Invitation.

At least one role must be selected. The inviting user can only assign roles at or below their own hierarchy level -- for example, a site_admin (level 10) cannot assign the tenant_admin role (level 5).

warnung

Invitations require the manage_members permission, which is available to org_owner, tenant_admin, and site_admin roles.

Invitation States​

StateDescription
PendingInvitation sent, not yet accepted
AcceptedUser has created an account and joined the organization
ExpiredInvitation was not accepted within 7 days
RevokedAdmin manually cancelled the invitation

Managing Pending Invitations​

In Settings > Members, switch to the Pending tab to see outstanding invitations:

  • Resend -- Send the invitation email again (useful if the original was missed).
  • Revoke -- Cancel a pending invitation so the link no longer works.

Updating Member Roles​

  1. Navigate to Settings > Members.
  2. Find the member in the list.
  3. Click the role dropdown next to their name.
  4. Select the new role(s). Multiple roles can be assigned simultaneously.
  5. The change takes effect immediately.

Role modifications enforce the same hierarchy check as invitations: you can only modify members whose highest role is below your own.

Removing Members​

  1. Navigate to Settings > Members.
  2. Click the ... menu next to the member's name.
  3. Select Remove from Organization.
  4. Confirm the removal.

Removing a member:

  • Revokes their access to all workspaces, projects, and boards.
  • Unassigns them from all items (the items remain but have no assignee).
  • Does not delete their comments or activity history.
  • Does not delete their user account -- they can still access other organizations they belong to.
warnung

You cannot remove the org_owner. Ownership must be transferred first before the owner can be removed.

Bulk Invitations​

For large teams, you can import members via CSV:

  1. Click Invite Members > Import CSV.
  2. Upload a CSV file with columns: email, role, workspaces (optional).
  3. Review the import preview.
  4. Click Send All Invitations.

Role Hierarchy Enforcement​

The invitation system enforces a strict role hierarchy to prevent privilege escalation:

  • A tenant_admin (level 5) can assign site_admin (level 10) and below.
  • A site_admin (level 10) can assign opex_coordinator (level 20) and below.
  • The org_owner role (level 0) can assign any role except org_owner itself.

If a caller attempts to assign a role at or above their own hierarchy level, the server returns a FORBIDDEN error. This check uses the canAssignRole helper function, which compares numeric role levels.

Member Limits​

Member limits depend on your plan. The system checks limits before processing each invitation:

PlanMember Limit
FreeUp to 5 members
StarterUp to 20 members
ProUnlimited members
EnterpriseUnlimited members

When the member limit is reached, new invitations are rejected with an error message indicating the plan needs to be upgraded.

Activity Logging​

All member management operations are logged to the activity trail:

  • Invitation sent -- Records the invitee email, assigned roles, and inviting user.
  • Invitation accepted -- Records when a new member joins the organization.
  • Role changed -- Records the old and new roles for the affected member.
  • Member removed -- Records which member was removed and by whom.

These events are visible in the Audit Log and support compliance requirements.