# Members and grants

> Invite members to a Vigilbase OS organisation, change their roles and add scoped grants for approvers, analysts and auditors.

Source: https://docs.vigilbase.com/os/settings/members

Vigilbase Identity manages membership: invitations, accounts and the member's role. Vigilbase OS adds **scoped grants** on top, so you can give one member extra permissions for a specific connection, dataset, resource or action class.

## Roles

| Role | Typical use |
|---|---|
| **Owner** | Full control, including membership, policy and deleting the organisation. Must use multi-factor authentication. |
| **Admin** | Integrations and operational configuration. Needs an explicit grant to approve actions. |
| **Viewer** | Read access to permitted pages and summaries. |

Analyst, approver and auditor rights are given with scoped grants, not roles.

Anyone who is an owner or holds privileged permissions, such as approving actions, must use multi-factor authentication.

## Invite a member

You need the `members.manage` permission.

:::steps
1. **Open Settings, then Members, and choose Invite.**
2. **Enter the Email.**
3. **Choose the Role.** New members are Viewers by default.
4. **Choose Send invitation** and confirm it's you.
:::

Vigilbase Identity sends the invitation email. The member appears in the list once they accept.

## Change a member's role

With the `members.manage` permission, choose a new role in the member's row and confirm it's you. You cannot change your own role.

## Add a scoped grant

A grant gives one member a permission, optionally narrowed and optionally until a date. For example, give a member `action.approve` for one connection only.

:::steps
1. **Open Settings, then Grants, and choose New grant.**
2. **Choose the Member and the Permission.** The permission defaults to `action.approve`.
3. **Choose the Scope:** **All**, **Org unit**, **Connection**, **Dataset**, **Resource** or **Action class**, and enter the scope value.
4. **Optionally set Expires.**
5. **Choose Create grant** and confirm it's you.
:::

To remove a grant, use its delete button. Changes to members and grants are recorded in [Activity](https://docs.vigilbase.com/os/activity).