> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kvelden.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Users

> Inviting, managing, disabling, offboarding, and removing users in your Enclave organisation.

## Inviting users

1. Navigate to **Organisation → Users**
2. Click **Invite user**
3. Enter their work email and select an organisation role
4. Click **Send invite**

The user receives an email with a time-limited invitation link (72 hours). If it expires, resend from the Users table.

## Organisation roles

| Role             | Description                                                                       |
| ---------------- | --------------------------------------------------------------------------------- |
| Owner            | Full organisation control — billing, settings, all data. Up to 3 per organisation |
| Org Admin        | Manages an org unit subtree and all users within it                               |
| Unit Admin       | Manages a single assigned Org Unit                                                |
| Security Officer | Security configuration and audit log access only — no file access                 |
| Member           | Standard user — access determined by Org Unit and room membership                 |
| Auditor          | Read-only compliance reports and audit logs — no file access                      |

<Warning>
  The Owner role has full control including the ability to delete the organisation. Assign it only to primary administrators. A maximum of 3 Owners are permitted per organisation.
</Warning>

## Clearance defaults by role

Each user's effective clearance is the higher of their role default and any explicit override.

| Role             | Default clearance |
| ---------------- | ----------------- |
| Owner            | C4                |
| Org Admin        | C4                |
| Security Officer | C4                |
| Unit Admin       | C3                |
| Member           | C2                |
| Auditor          | C2                |

To override: **Organisation → Users → (user) → Set Clearance**.

## Multi-membership

Users can belong to **multiple Org Units**. Each membership is explicit — there is no implicit access from admin roles or parent units.

To manage memberships:

1. Navigate to **Organisation → Users**
2. Click the user row menu → **Manage memberships**
3. Add or remove Org Unit memberships in the dialog

Each membership can carry a role (manager, contributor, viewer) independent of the user's organisation-wide role.

<Note>
  Owner and Org Admin roles do **not** grant implicit file access. Admins must still hold explicit Org Unit membership to access files in rooms owned by that unit.
</Note>

## Removing people: disable, offboard, or remove

Enclave separates three distinct actions — pick the one that matches your intent. All are available from **Organisation → Users → (user row menu)**.

| Action       | What it does                                                                       | Reversible | Approval      |
| ------------ | ---------------------------------------------------------------------------------- | ---------- | ------------- |
| **Disable**  | Freezes the account — instant logout, no sign-in until re-enabled                  | Yes        | Single admin  |
| **Offboard** | Departing member — reassigns their documents to the org, anonymises their identity | No         | Two approvers |
| **Remove**   | Complete cleanup — destroys their files and anonymises the account                 | No         | Two approvers |

## Disabling (freezing) a user

Use **Disable account** to immediately freeze an account — for example on suspected compromise or suspicious activity.

Disabling a user:

* **Ends every live session instantly** — active web sessions and open secure-room connections are terminated and the login token is revoked, so their next action lands them back on the sign-in screen.
* Blocks all future sign-ins until the account is re-enabled.
* **Changes no data** — files, room and Org Unit memberships, keys, and clearance are all left intact.

Disabling is **fully reversible** — choose **Re-enable account** from the same menu (the user signs in again). Use disable for a temporary freeze, not a departure.

<Note>
  Disable does **not** remove the person from rooms or Org Units — it only locks the account. To remove a departing member's access and identity, use **Offboard** or **Remove** below.
</Note>

## Offboarding a member

Use **Offboard member** when someone leaves the organisation. Offboarding preserves the organisation's documents while erasing the individual:

* **Reassigns** every document they owned to the organisation's primary owner — business records are never destroyed.
* **Anonymises** their identity (name, email, avatar, credentials) to a tombstone and revokes their sessions.
* **Crypto-shreds** their zero-knowledge keys and **removes** them from all rooms and Org Units.
* Keeps a de-identified audit record for compliance (DPDP).

Offboarding is a **governed, two-person action** and cannot be undone, so it runs through an approval:

1. **Organisation → Users → (member) → Offboard member → Request offboarding.** (You can also start it from **Privacy & Compliance → Privacy Requests** when a member has filed an erasure request — use **Start offboarding**.)
2. A **second eligible approver** (a different Owner or Org Admin) opens **Privacy & Compliance → Data-Rights Approvals** and approves. Two approvals are required, and the requester cannot approve their own request.
3. Once approved, the erasure runs automatically.
4. For any **Zero-Knowledge rooms** the member belonged to, open the room's **Members** tab and use the **Rotate Key** reminder to rotate the room key for forward secrecy.

<Note>
  Two-person approval means your organisation needs at least **three** eligible approvers (the requester plus two Owners/Org Admins) for offboard and remove to complete.
</Note>

Offboarded members are hidden from the default roster; view them under **Organisation → Users → Status: Offboarded** as a de-identified record with no further actions.

## Removing a member (destroy & purge)

Use **Remove user** for a complete cleanup — for example a mistaken or test account, or when the organisation requires the person's files destroyed rather than retained:

* **Destroys** every file they owned (database records and stored objects) — unlike offboarding, their content is **not** reassigned.
* Crypto-shreds their keys, revokes sessions, anonymises the account, and removes them from all rooms and Org Units.

Like offboarding, removal is **irreversible** and requires **two approvers**:

1. **Organisation → Users → (member) → Remove user → Request removal.**
2. A second eligible approver approves in **Privacy & Compliance → Data-Rights Approvals**.
3. The cleanup runs once two approvals are recorded.

<Warning>
  Remove **destroys** the member's files. If those documents matter to the organisation, use **Offboard** instead — it reassigns them to the primary owner.
</Warning>

## Bulk import

Use **Import users** to provision multiple users at once via CSV:

```csv theme={null}
email,role
alice@company.com,Member
bob@company.com,Member
carol@company.com,Unit Admin
```

Download the template from **Organisation → Users → Import**. Org Unit memberships are assigned separately after the accounts are created.