# Administer your organization Day-to-day tasks for owners and admins, from invitations and roles to seats, machines, organization settings and the billing portal. Source: https://usezn.com/docs/team/admin/ This guide is for the people who run an organization in Team: the **owner**, who created it, and the **admins**. Who can do what is summarized in the [roles table](https://usezn.com/docs/team/); this page shows how. Owners and admins need [two-factor authentication](https://usezn.com/docs/account-security/) for sensitive actions. Set it up before you start: **Settings → Security**. ## Invite people 1. Open **Team → Members** and select **Invite**. 2. Enter their email address and pick a role: **member**, **admin** or **auditor**. Only the owner can invite admins and auditors. 3. The dashboard shows an invitation link. zn does not send the email: share the link with them yourself. It works once, for that email address, for **7 days**, and they accept it signed in with that address. Rules: - Members and admins take a seat, and so does a pending invitation. If every seat is in use, add seats first (see below). - **Auditors do not take a seat.** They can read the audit log and download exports, nothing else, and they do not install zn-gate. - A person can belong to one organization at a time. - You can revoke a pending invitation from the same list; that frees its seat at once. ## Change roles and remove people - **Only the owner changes roles**: member to admin, admin back to member, or anyone to or from auditor. Making someone an admin or an auditor asks for two-factor authentication. - Admins can remove members. Only the owner can remove admins and auditors. - The owner's role cannot change, and the owner cannot be removed. - Removing someone ends their access to the organization at once, and the agent tokens they created stop working. Their machines stay connected: revoke their installations as well (see below) if those machines should stop receiving the policy and uploading. ## Connect machines Machines join with a join token. An owner or admin creates one with **New join token** under **Connected installations**. A join token is valid for **7 days** and for a set number of machines (by default, the number of seats). Developers then run the join command on their machine: see [Join a machine](https://usezn.com/docs/team/join/). **Connected installations** lists each machine with its agent, its audit records and when it was last seen, so you can spot machines that are out of date or silent. **Revoke** stops an installation from receiving the policy and from uploading. ## Policy Owners and admins publish the policy from **Team → Policies**. Each machine downloads it, checks its signature and applies it; a published policy stays valid for 7 days without a new download, so a machine that is offline for a while keeps enforcing it. If two people publish at the same time, the second is asked to reload. Details in [Organization policy](https://usezn.com/docs/team/policy/) and [Offline behavior](https://usezn.com/docs/team/offline/). Each rule is in one of three states: **Not blocked** (the default), **Warn** (the use goes through, the developer gets a warning and the audit log records it) or **Block** (the use is stopped). Choosing **Block** asks you to confirm it; **Warn** does not. Restrictions apply to all agents on members' machines: a rule written for one agent also applies to the others, and warn and block rules ignore the agents list. The agents list only decides which agents are offered a new host. Warned and blocked uses appear in Team → Audit log as **Warned** and **Blocked**. ## Seats, the shared pool and billing These are for the owner only, and the billing portal asks the owner for two-factor authentication. - **Seats:** open **Team → Billing & seats** and select **Manage seats in Polar**. You can have from 2 to 50 seats. Seat changes are confirmed by Polar and show in the dashboard once applied. You cannot go below the seats in use (members, admins and pending invitations); remove people or revoke invitations first. - **Pay-as-you-go cap (monthly plan):** after the shared pool of calls is used, calls stop unless the owner sets a monthly cap above $0 in **Team → Billing & seats → Pay-as-you-go cap** (up to $10,000; changing it asks for two-factor authentication). Calls beyond the pool cost $0.10 per 1,000, up to that cap. Lowering the cap takes effect at once. During the trial the pool is a hard limit. - The pool and the cap count calendar months (UTC). Usage is reported to the billing provider every hour and billed on the next invoice of the subscription, whose period starts on the day you subscribed, so one invoice can include usage from two calendar months. - Usage reported after a subscription ends, or after you switch from the monthly to the annual plan, is not added to a later invoice. - **Organization credits (annual plan):** calls beyond the pool use prepaid organization credits at $0.10 per 1,000 calls ($1 = 10,000 calls). In **Team → Billing & seats → Organization credits**, enter an amount from $10 (whole dollars) and finish the payment on the checkout page; taxes, if any, are added there. Credits are added when the payment is confirmed, never expire, and the balance shows on the same card. Buying them asks for two-factor authentication. When the credits run out, calls stop at the pool until next month or until you buy more. - **Billing portal:** the same button opens the billing portal, where you also update the card, download invoices or cancel the subscription. Cancelling takes effect at the end of the period. ## Organization settings In **Team → Settings** the owner chooses how changes proposed by an agent are approved: confirmed in the agent, always approved in the dashboard, or not allowed (agents can only read). Changing this setting asks for two-factor authentication and a sign-in from the last 10 minutes. See [Manage your team from your agent](https://usezn.com/docs/team/agents/). ## Audit and evidence Owners, admins and auditors can read **Team → Audit** and download exports from **Team → Evidence**: the zn-gate audit trail and members' cloud checks, as CSV, JSON or OpenTelemetry logs. Every export is recorded in the organization's activity log with its row count and checksum. See [Export the audit trail](https://usezn.com/docs/team/export/) and the [SOC 2 evidence guide](https://usezn.com/docs/team/soc2/).