Members and roles

Understand the five roles, see who can do what, and invite, change, disable and remove the people in your organization.

Each person in Altrum belongs to one organization and holds one of five roles. Roles are fixed: you cannot create your own or combine two.

Role	Usually given to	What it is for
Owner	The accountable executive	Everything, including making other owners.
Admin	Whoever runs IT or the AI platform	Runs Altrum and the AI Gateway: people, keys, provider credentials and budgets. Does not approve.
Governance Lead	Risk, compliance or data protection	Approves AI systems, models and MCP servers, and handles incidents and access reviews.
Member	Developers and the owners of AI products	Registers and runs the AI systems they own, and uses a personal key.
Auditor	Internal or external audit	Reads the governance record and changes nothing.

Who approves

Approving is kept apart from running the platform. An admin sets up keys, providers and budgets; an owner or a Governance Lead decides whether an AI system goes live and which models and MCP servers are allowed.

For an AI system rated High or Very high, the person who asked for approval cannot also give it, once your organization has two or more people who can approve. In a small organization with a single owner, the owner does it all and nothing waits. See Lifecycle.

The owner of an AI system

Every AI system names one person as its owner. Whatever their role, that person can run its assessment, set up its guardrails, change its risk profile, ask for its approval, take it live, pause it, and open and handle its incidents. A Member who registers an AI system becomes its owner.

Invite someone

1. Open Members

   Choose Members at the bottom of the sidebar, then Invite member.

2. Send the invitation

   Enter their email address, choose a role, and choose Send invitation.

They get an email with a link that works once, for 7 days. Open invitations appear under the members table. Resend sends a fresh link and ends the old one; Withdraw cancels the invitation. You can send up to 30 invitations and resends an hour.

An address that already has an Altrum account cannot be invited, because one email address belongs to one account in one organization.

Change a role

In the members table, open the menu at the end of a row and choose Change role. The new role applies straight away, and the person is emailed.

Disable, enable or remove someone

Action	What happens
Disable	They are signed out everywhere and cannot sign in. Their work stays. Their personal keys stop working, and stay off if they are enabled again. They are emailed.
Enable	They can sign in again, and are emailed a link to do it.
Remove	They leave the organization and every project, and are signed out. Their personal keys stop working. To bring them back, invite them again.

An auditor keeps access until you remove them or change their role, so remove an external auditor when the audit ends.

Rules that always hold

• Nobody can change their own role, or disable or remove themselves.
• Only an owner can make someone an owner, or change an owner. An admin sees no menu on an owner’s row.
• An organization always keeps at least one active owner.

What each role can do

“Own” means the person is named as the AI system’s owner.

AI systems, assessments and guardrails

	Owner	Admin	Governance Lead	Member	Auditor
See AI systems, assessment results and guardrails	Yes	Yes	Yes	Yes	Yes
Register an AI system	Yes	Yes	Yes	As its owner	No
Edit and retire AI systems, and name their owner	Yes	Yes	Yes	No	No
Ask for approval, take live, pause and resume	Yes	Yes	Yes	Own	No
Approve, send back and restore	Yes	No	Yes	No	No
Run assessments, set up guardrails, change the risk profile	Yes	Yes	Yes	Own	No
See red-team runs	Yes	Yes	Yes	Yes	Yes
Run a red-team on an AI system’s guardrails	Yes	Yes	Yes	Own	No
Run a red-team on the organization’s guardrails	Yes	Yes	Yes	No	No

Projects

	Owner	Admin	Governance Lead	Member	Auditor
See projects	Yes	Yes	Yes	Yes	Yes
Create, rename and delete projects, and choose their lead	Yes	Yes	No	No	No
Move AI systems into or out of a project	Yes	Yes	Yes	No	No
Change a project’s description and members	Yes	Yes	As its lead	As its lead	No

Models, MCP servers and Discover

	Owner	Admin	Governance Lead	Member	Auditor
See the Model catalog	Yes	Yes	Yes	No	Without requests or spend
Approve or block models	Yes	No	Yes	No	No
See MCP servers under AI assets	Yes	Yes	Yes	No	Yes
Set an MCP server’s owner, description and tool risks	Yes	Yes	No	No	No
Approve or block an MCP server	Yes	No	Yes	No	No
See Discover	Yes	Yes	Yes	No	No
Register, attach and dismiss traffic in Discover	Yes	Yes	No	No	No

AI Gateway

	Owner	Admin	Governance Lead	Member	Auditor
See keys, credentials, guardrails, request log and settings	Yes	Yes	Yes	No	No
Change keys, limits and settings	Yes	Yes	No	No	No
Add and remove provider credentials and MCP servers	Yes	Yes	No	No	No
Read stored prompts and replies	Yes	Yes	Yes	No	No
Create personal keys and connect MCP accounts, when allowed	Yes	Yes	Yes	Yes	No

Monitoring

	Owner	Admin	Governance Lead	Member	Auditor
See Reporting	Yes	Yes	Yes	No	No
See every budget	Yes	Yes	Yes	No	No
Change budgets	Yes	Yes	No	No	No
See your own alerts, and choose which reach you by email	Yes	Yes	Yes	Yes	Yes
Switch alert rules on and off and change thresholds	Yes	Yes	Yes	No	No
See incidents	Yes	Yes	Yes	Yes	Yes
Open and change incidents	Yes	Yes	Yes	Own, or assigned to them	No

Proof

	Owner	Admin	Governance Lead	Member	Auditor
See access reviews	Yes	Yes	Yes	No	Without spend
Run access reviews	Yes	Yes	Yes	No	No
Read and export compliance reports	Yes	Yes	Yes	No	Yes
See the audit trail	Yes	Yes	Yes	No	Yes

People, organization and support

	Owner	Admin	Governance Lead	Member	Auditor
See the members	Yes	Yes	Yes	No	Yes
Invite, resend and withdraw invitations	Yes	Not for an owner	No	No	No
Change roles	Yes	Not an owner’s, nor to Owner	No	No	No
Disable, enable and remove	Yes	Not an owner	No	No	No
Edit the organization profile	Yes	Yes	No	No	No
Raise support tickets and see your own	Yes	Yes	Yes	Yes	Yes
See every support ticket	Yes	Yes	No	No	No
Edit your own details	Yes	Yes	Yes	Yes	Yes

Emails

	Owner	Admin	Governance Lead	Member	Auditor
Emails about AI systems and the organization	Yes	No	No	No	No
Requests to approve AI systems	Yes	No	Yes	No	No

Who hears about an alert

Spend, traffic and key alerts go to owners and admins. Guardrail and governance alerts, including waiting approvals, go to owners and Governance Leads. The owner of an AI system, the lead of its project and the holder of a key also hear about their own, whatever their role. See Alerts.