Platform/Organizations & members
How organizations work in the ForgeAI cockpit: automatic creation on signup, roles and permissions, inviting members, teams, and organization settings.
Everything in the ForgeAI cockpit lives inside an organization: projects, workflows, the task board, registered CLI devices, and billing. An organization is the tenant boundary — data never crosses between organizations.
When you sign up, ForgeAI automatically creates an organization for you. It is named after the first 8 characters of your email address (for example jeremy.b's org) with an auto-generated slug and a default logo. You can rename it and replace the logo at any time in Settings.
After signing in, /orgs redirects you to your first organization at /orgs/[orgSlug]. If you belong to no organization (for example after leaving your last one), you are sent to /orgs/new instead.
The organization home page at /orgs/[orgSlug] is a dashboard with three areas:
Members with the right permissions also get New Project and Invite member shortcut buttons in the header.
On the main organization pages (Dashboard and the projects list), the top of the sidebar has a search box — click it or press Cmd/Ctrl+K to open the command menu. It is not available inside organization settings or project pages. With no query it lists shortcuts to every organization page (Dashboard, Projects, Settings, Members, and so on); typing searches the organization's members by name or email, and selecting a result opens the Members page. During the beta, search covers members only — projects, tasks, and workflows are not searchable from the command menu yet.
Create additional organizations at /orgs/new. You choose a name and a URL slug; the slug is auto-generated from the name and checked for availability as you type. You cannot create a new organization once you already belong to 5 organizations — invitations can still add you to more.
Every member has one of three built-in roles: member, admin, or owner (the person who created the organization).
| Capability | Member | Admin | Owner |
|---|---|---|---|
| Create projects | Yes | Yes | Yes |
| Update and delete projects | — | Yes | Yes |
| Create and assign tasks | Yes | Yes | Yes |
| Reassign, update, delete tasks | — | Yes | Yes |
| View agents | Yes | Yes | Yes |
| Dispatch and cancel agents | — | Yes | Yes |
| Create and execute workflows | Yes | Yes | Yes |
| Update and delete workflows | — | Yes | Yes |
| Manage members, roles, teams | — | Yes | Yes |
| Manage billing and subscription | — | — | Yes |
| Share projects | — | — | Yes |
| Delete the organization | — | — | Yes |
Note: the Billing link in the sidebar is visible to admins, but billing pages require the subscription-management permission, which only the owner role has by default.
Admins can define custom roles at Settings → Roles (/orgs/[orgSlug]/settings/roles), picking permissions across six domains: project, subscription, users, task, agent, and workflow. Custom roles are assigned from the member list once someone has joined — the invite dialog currently offers only the built-in member and admin roles.
Admins and owners invite people by email from Settings → Members (/orgs/[orgSlug]/settings/members) using the Invite dialog:
The invitee receives an email with a link to /orgs/accept-invitation/[id]. If they are already signed in, one click on Accept Invitation takes them into the organization. If they are signed out, the invitation page shows the sign-in options inline and returns them to the invitation afterwards. An invitation link that no longer exists shows "Invitation Not Found"; expired or revoked invitations still display the join card, but accepting them fails with an error.
The number of members per organization depends on the plan (see Plans & billing):
| Plan | Members |
|---|---|
| Free | 3 |
| Pro | 10 |
| Ultra | 100 |
The server-side check counts existing members plus pending invitations and rejects any invitation beyond the limit. The Invite button is replaced by an upgrade dialog (showing your current usage) once the member count alone reaches the limit — so with pending invitations outstanding, the invite form can still open and the invitation is then rejected by the server.
Beta note: independently of the plan, the platform currently enforces a hard cap of 10 members per organization, so the Ultra tier's 100-member limit is not yet reachable in practice.
On the Members page, admins can:
Two safeguards apply: the last owner cannot be demoted and cannot leave the organization (ownership must be transferred first), and every other member can leave the organization from their own row.
Teams are enabled and managed by admins at Settings → Teams (/orgs/[orgSlug]/settings/teams), which lists all teams with their members.
Beta note: assigning a member to a team while inviting them is not yet available in the invite dialog.
The Organization section of the sidebar links to these routes:
| Route | Purpose | Visible to |
|---|---|---|
/orgs/[orgSlug]/settings | Organization name, logo, task-dispatch pause | Admins |
/orgs/[orgSlug]/settings/members | Members and invitations | All members |
/orgs/[orgSlug]/settings/cli-devices | Registered CLI devices | All members |
/orgs/[orgSlug]/settings/roles | Custom roles | Admins |
/orgs/[orgSlug]/settings/teams | Teams | Admins |
/orgs/[orgSlug]/settings/billing | Plan, usage, payment | Admins (owner-only access) |
/orgs/[orgSlug]/settings/danger | Change the URL slug, delete the organization | Owner |
The owner always passes admin-gated checks.
The Agents card on the settings page sets the organization's defaults for agent execution: for each engine that at least one device declares models for, the model to use (picked from the declared lists — no free typing), plus a default reasoning effort (Low / Medium / High / Max — effort is the thinking control on every modern engine). Projects inherit these defaults and can override them in their own settings; board columns can refine the effort (and model) per pipeline step. At dispatch, the cockpit resolves column → project → organization and only sends the task to devices that declare the demanded model; when none does, the task shows a "No compatible device" badge until the demand or a device's list changes.
Settings lets admins change the organization name and logo. Logo uploads accept images only, up to 2 MB. During the beta, file uploads are disabled unless blob storage is configured on the deployment, so the upload can fail — the default logo is used until then.
The same page has a Task Dispatch switch that pauses automatic task dispatch to CLI agents across the whole organization — useful when you want the board to stop handing work to agents without disconnecting any CLI.
Every member can view Settings → CLI Devices to see the organization's registered CLI devices and their live status. Linking a CLI to an organization happens during CLI authentication — approving a device requires membership in at least one organization. The number of CLI connections is also limited per plan (see Plans & billing).
Settings → Danger Zone is owner-only and holds two operations. The first changes the organization's URL slug — every existing organization URL stops working, so links must be updated everywhere.
The second is organization deletion, which is permanent: it deletes all members, teams, custom roles, pending invitations, and billing data. All members are notified by email, and no refund is provided for any active subscription.