Using BetterContext Copy

Invite Team Members & RBAC

Managing organization members, role-based access controls (RBAC), and enterprise Single Sign-On (SSO).

Collaborative multi-agent workflows require strict team governance. BetterContext allows organizations to onboard teammates, assign granular role boundaries, and integrate with enterprise identity providers.

Role-Based Access Control (RBAC)

Role	Permissions	Intended Audience
Owner	Full administrative control, billing management, workspace deletion, and SSO configuration.	CTO, Head of Engineering, Organization Founder.
Admin	Manage members, generate service tokens, configure connectors, and edit ACL policies.	Engineering Leads, DevOps / Platform Engineers.
Member	Read and write to authorized repository graphs, query agents, and author skills.	Software Engineers, Product Managers.
Viewer	Read-only access to documentation and memory graphs; cannot create or mutate nodes.	Auditors, Executives, Support Staff.

Sending Invitations

Team administrators can invite members via the Web Console or CLI:

# Invite an engineer with 'member' permissions
bettercontext org invite \
  --email "[email protected]" \
  --role "member" \
  --workspaces "engineering,docs"

The invited teammate will receive a secure magic link to join the workspace and immediately configure their personal CLI or MCP tokens.

Enterprise SAML & SSO

Scale and Enterprise plans support SAML 2.0 and OIDC integrations for automated directory sync:

Supported IdPs: Okta, Google Workspace, Microsoft Entra ID (Azure AD), JumpCloud, and OneLogin.
Just-In-Time (JIT) Provisioning: Employees automatically receive accounts and assigned workspaces on their first login.
SCIM Deprovisioning: When an employee is offboarded in your identity provider, their API keys and agent sessions are immediately terminated.

Next Steps

Was this page helpful?

ON THIS PAGE

Overview
RBAC Matrix
Sending Invitations
Enterprise SSO & SCIM
Next Steps