> ## Documentation Index
> Fetch the complete documentation index at: https://docs.arya.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Team and roles

> Invite users, manage roles, granular per-module permissions.

Team is Arya's engine. Correct role and permission configuration avoids confusion and protects sensitive data.

## Invitations

<Steps>
  <Step title="Settings → Team → + Invite">Email or bulk CSV.</Step>
  <Step title="Pick role">See next section.</Step>
  <Step title="Custom message (optional)">For invitation context.</Step>
  <Step title="Send">Recipient gets email with registration link.</Step>
</Steps>

## Standard roles

| Role          | Typical permissions                                              |
| ------------- | ---------------------------------------------------------------- |
| **Admin**     | All: settings, billing, team, sensitive data                     |
| **Manager**   | See/edit team data, create automations, approve requests         |
| **User**      | Manage own records + shared ones, create tasks, use integrations |
| **Read-only** | Read only (external consultants, accountants)                    |
| **Guest**     | Limited access to a specific project (customer)                  |

## Custom roles

For specific cases create custom roles:

<Steps>
  <Step title="Team → Roles → + New role">Name, description.</Step>

  <Step title="Per-module permissions">
    For each module (CRM, HR, Finance...) set:

    * **None**: doesn't see
    * **Read only**: sees, doesn't edit
    * **Edit own**: create/edit only owned records
    * **Edit team**: also team records
    * **Edit all**: also others' records
  </Step>

  <Step title="Field-level permissions">For sensitive fields (salary, IBAN) hide or make read-only.</Step>
  <Step title="Save and assign">Apply new role to existing users.</Step>
</Steps>

## Teams and hierarchies

<Steps>
  <Step title="Create team">Sales, Operations, HR, etc.</Step>
  <Step title="Assign members">Each user can belong to multiple teams.</Step>
  <Step title="Team manager">Designate manager. Sees/edits member data.</Step>
  <Step title="Sub-teams">Teams can have sub-teams (multi-level hierarchy).</Step>
</Steps>

## Single Sign-On (SSO)

For companies with identity providers (Google Workspace, Microsoft Azure AD, Okta):

<Steps>
  <Step title="Settings → Team → SSO">Pick provider.</Step>
  <Step title="Configure">SAML / OpenID Connect metadata. Arya provides exact instructions.</Step>
  <Step title="Verify">Test login.</Step>
  <Step title="Force SSO">Option: disable password login, SSO only (more secure).</Step>
</Steps>

## Audit log

Every change to team, roles, permissions is logged:

* Who did what
* When
* From which IP
* What changed (before/after)

Export audit log as CSV for compliance (SOC2, ISO 27001).

## User deactivation

<Steps>
  <Step title="Team → User → Deactivate">Doesn't delete, preserves history.</Step>
  <Step title="Record transfer">Arya asks to whom to reassign user's deals, tasks, projects.</Step>
  <Step title="Access revocation">Tokens and sessions invalidated immediately.</Step>
  <Step title="Reactivation">Always possible from the panel.</Step>
</Steps>

## User cost

Arya cost is per active user. Deactivated users don't count. Guest users may have dedicated pricing (see plans).