---
title: Organization Members
url: "/docs/account/organization-members/"
canonical_url: https://docs.blossom88.com/docs/account/organization-members/
markdown_url: https://docs.blossom88.com/docs/account/organization-members.md
summary: Roles, Account access, Permission Sets and who can see billing
categories:
- account
- user-guide
- account-management
---

# Organization Members

An Organization owns billing and membership. Its Accounts own Apps, data,
Capacity and the other resources your team operates. Membership is granted at
the Organization level; what a member can do inside each Account comes from
their Account access.

Manage members under **Organization → Members**. Admins can also send
invitations and define Permission Sets there.

## Roles

| Role | What it allows |
|---|---|
| Owner | Everything an Admin can do, plus adding or removing other Owners and closing the Organization. An Organization always keeps at least one Owner. |
| Admin | Manage Organization settings, billing, members, invitations and Accounts. Admins have full access to every Account. |
| Member | Use the Accounts they have access to. |

Changing a member to or from Owner asks for the exact Organization name.

## Account Access

A Member has one of two access shapes:

- **Selected accounts**: access only the Accounts with a direct grant. Each
  grant carries its own role and permissions, so one person can be an Account
  admin in staging and read only in production.
- **All accounts**: access every current and future Account in the
  Organization, with one permission choice applied everywhere.

Either shape uses the same permission choices as API tokens:

- **Full access**: every permission for that Account. For a Member, that
  covers the Account's resources but not money: Billing needs Billing named
  in a custom permission choice.
- **Read only**: read permissions for current and future resources.
- **Custom**: exactly the permissions you pick, ideally saved as a Permission
  Set so several people share one audited definition.

## Billing Access

Billing is an Organization privilege, separate from working in an Account:

- Invoices, the payment portal and the billing email need Organization billing
  access: an Owner, an Admin, or a Member with **All accounts** access whose
  permissions include Billing.
- A Member with a direct Account grant that names Billing sees that Account's
  usage, limits, alerts, summaries and CSV only. Full access or Read only
  alone does not show a Member money; their menus leave Billing out.

To give a finance teammate the bill without making them an Admin, add them as
a Member with **All accounts** access and a custom permission choice limited to
the Billing group. API tokens follow the same rule through the token's user.

## From The CLI

    blossom organization:member:list
    blossom organization:member:init

writes member.yml:

```yaml
member:
  role: member
  # Use all for every current and future account.
  # Use selected when this member should use only the accounts below.
  account_access: all
  permission_set_id: read_only
  # ...
```

    blossom organization:member:update --id organization_user-100 --data member.yml
    blossom permission_set:list

See the [member update reference](/docs/reference/cli/organization/member/update/)
for the `member.yml` shapes and the
[Permission Set commands](/docs/reference/cli/permission_set/).