> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/cline/cline/llms.txt
> Use this file to discover all available pages before exploring further.

# Team management

> Invite members, assign roles, manage seats, and offboard users in your Cline Enterprise organization.

This guide covers day-to-day member administration in your Cline Enterprise organization — inviting users, changing roles, removing members, and managing your license seats.

## Roles and permissions

Cline Enterprise uses a three-tier role hierarchy:

<CardGroup cols={3}>
  <Card title="Owner" icon="crown">
    **Primary account holder.** Unrestricted access including billing, security settings, and ownership transfer. Limit to 1–2 individuals.
  </Card>

  <Card title="Admin" icon="user-gear">
    **Team leads and IT managers.** Can manage members and configure providers. Cannot access billing.
  </Card>

  <Card title="Member" icon="user">
    **Developers and contributors.** Can use Cline with shared provider access. Cannot change settings. The correct default for most users.
  </Card>
</CardGroup>

### Permissions matrix

| Permission                 | Member | Admin | Owner |
| :------------------------- | :----: | :---: | :---: |
| **General usage**          |        |       |       |
| Use Cline                  |    ✅   |   ✅   |   ✅   |
| Access shared AI providers |    ✅   |   ✅   |   ✅   |
| **Member management**      |        |       |       |
| View members               |    ❌   |   ✅   |   ✅   |
| Invite new members         |    ❌   |   ✅   |   ✅   |
| Edit member roles          |    ❌   |   ✅   |   ✅   |
| Remove members             |    ❌   |   ✅   |   ✅   |
| Remove admins              |    ❌   |   ❌   |   ✅   |
| **Configuration**          |        |       |       |
| Configure API providers    |    ❌   |   ✅   |   ✅   |
| Manage security settings   |    ❌   |   ❌   |   ✅   |
| **Billing and ownership**  |        |       |       |
| View billing information   |    ❌   |   ❌   |   ✅   |
| Manage subscription        |    ❌   |   ❌   |   ✅   |
| Transfer ownership         |    ❌   |   ❌   |   ✅   |

<Note>
  Most users should be **Members**. Grant **Admin** only to those who manage users or provider configurations. Reserve **Owner** for 1–2 account leaders.
</Note>

## Member management

<Tabs>
  <Tab title="Inviting members">
    ### Inviting new team members

    1. Go to your organization dashboard at [app.cline.bot](https://app.cline.bot).
    2. Click **Members** in the sidebar.
    3. Click **Invite Member**.
    4. Enter the user's email address (must be from your verified domain).
    5. Select the appropriate role: Member, Admin, or Owner.
    6. Click **Send Invite**.

    Invited users receive an email with a join link. Pending invitations appear in your member list with a **Pending** status and hold one seat from your license.

    <Tip>
      Need to add many users at once? Contact [support@cline.bot](mailto:support@cline.bot) for assistance with bulk CSV invite imports.
    </Tip>

    <Info>
      If SSO is configured, users can also be provisioned automatically on their first sign-in without a manual invite. See [Onboarding](/enterprise/onboarding).
    </Info>
  </Tab>

  <Tab title="Editing roles">
    ### Changing a member's role

    1. Navigate to the **Members** page.
    2. Find the user you want to modify.
    3. Click the dropdown next to their current role.
    4. Select the new role and confirm the change.

    Role changes take effect immediately. The user may need to sign out and back in to see updated permissions in the Cline extension.

    <Warning>
      Downgrading an Admin to Member immediately revokes their ability to manage users and configurations. Only Owners can remove Admins.
    </Warning>
  </Tab>

  <Tab title="Removing members">
    ### Removing a member

    1. Navigate to your organization's **Members** page.
    2. Locate the user to remove.
    3. Click the menu icon (⋮) next to their name.
    4. Select **Remove from Organization** and confirm.

    The user loses access immediately. Their seat is freed and can be assigned to another user.

    <Info>
      Removing a member does not delete their historical activity logs. All audit trails are preserved for compliance.
    </Info>
  </Tab>

  <Tab title="Revoking invitations">
    ### Canceling a pending invitation

    If an invited user has not yet accepted, you can revoke the invitation:

    1. Find the pending invitation in your **Members** list.
    2. Click **Revoke Invitation**.
    3. The seat is freed immediately.

    This is useful when the wrong email was used, the user no longer needs access, or you need to reassign the seat urgently.
  </Tab>
</Tabs>

## Access requirements

For users to join your organization, two conditions must be met:

<Steps>
  <Step title="Verified identity provider">
    Your organization must have a verified identity provider (IdP) such as Okta, Microsoft Entra ID (Azure AD), Google Workspace, or AWS IAM Identity Center. Users authenticate through your IdP.
  </Step>

  <Step title="Verified domain">
    Your organization must have a verified domain. Only users with email addresses from verified domains can join. Domain verification is completed through your domain registrar or DNS provider.
  </Step>
</Steps>

## Seat management

<AccordionGroup>
  <Accordion title="How seats are calculated" icon="chair">
    * Each active user (Owner, Admin, or Member) consumes one seat.
    * Pending invitations also hold one seat.
    * Removing a member or revoking an invitation immediately frees the seat.
    * Your license determines the maximum number of seats available.
  </Accordion>

  <Accordion title="When a seat is consumed" icon="user-plus">
    A seat is consumed when:

    * You send an invitation (marked as Pending)
    * An invited user accepts and joins
    * A user gains access through SSO just-in-time provisioning
  </Accordion>

  <Accordion title="Freeing up seats" icon="user-minus">
    To free a seat:

    * Remove an active member from the organization
    * Revoke a pending invitation
  </Accordion>

  <Accordion title="Upgrading your license" icon="arrow-up">
    * **Teams plan:** Visit [app.cline.bot/settings/billing](https://app.cline.bot/settings/billing) or contact your account manager.
    * **Enterprise plan:** Includes unlimited seats.
  </Accordion>
</AccordionGroup>

## Security best practices

<CardGroup cols={2}>
  <Card title="Principle of least privilege" icon="shield-check">
    Assign the minimum role necessary. Most users should be Members. Grant Admin or Owner only when required for job duties.
  </Card>

  <Card title="Limit Owner roles" icon="user-lock">
    Keep Owners to 1–2 individuals who manage billing and security. This prevents accidental or unauthorized changes to critical settings.
  </Card>

  <Card title="Regular audits" icon="clipboard-check">
    Review your member list quarterly. Remove inactive users promptly and verify that Admin and Owner roles are still appropriate.
  </Card>

  <Card title="Offboarding process" icon="door-open">
    When offboarding a developer: remove them from Cline, revoke IdP access, and document the change in your audit log.
  </Card>
</CardGroup>

<Warning>
  Owners control billing and can transfer ownership. Choose these individuals carefully and document the selection in your organization's security policies.
</Warning>

## Advanced scenarios

<AccordionGroup>
  <Accordion title="Transferring ownership" icon="exchange">
    Only the current Owner can transfer ownership:

    1. Navigate to **Organization Settings**.
    2. Go to the **Ownership** section.
    3. Select the new Owner from the member list.
    4. Confirm with your authentication.

    This action cannot be undone by the previous Owner. The new Owner must initiate a reverse transfer if needed.
  </Accordion>

  <Accordion title="Multiple admins" icon="users-gear">
    When you have multiple Admins:

    * Document each Admin's area of responsibility.
    * Use audit logs to track configuration changes.
    * Establish escalation paths for Owner-level decisions.
  </Accordion>

  <Accordion title="Temporary access for contractors" icon="clock">
    For contractors or temporary staff:

    * Create them as Members.
    * Set calendar reminders to remove them when the engagement ends.
    * Consider using time-limited IdP accounts if your IdP supports it.
  </Accordion>
</AccordionGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="User cannot accept invitation" icon="circle-exclamation">
    **Common causes:**

    * Email domain does not match the verified domain.
    * User's IdP account has not been created yet.
    * Invitation link has expired.

    **Fix:** Verify domain verification is complete and resend the invitation.
  </Accordion>

  <Accordion title="Cannot remove an Admin" icon="user-slash">
    **Cause:** Only Owners can remove Admins.

    **Fix:** Ask an Owner to perform the removal. If you need to remove your organization's sole Owner, contact [support@cline.bot](mailto:support@cline.bot).
  </Accordion>

  <Accordion title="Out of seats" icon="triangle-exclamation">
    **When you've reached your license limit:**

    * Remove inactive members to free seats.
    * Revoke pending invitations that are no longer needed.
    * Upgrade your license to add more seats.
  </Accordion>
</AccordionGroup>