Organization Members

Roles, Account access, Permission Sets and who can see billing

account user-guide account-management 3 min read

An Organization owns billing and membership. Its Accounts own Apps, data, Capacity and the other resources your team operates. Membership is granted at the Organization level; what a member can do inside each Account comes from their Account access.

Manage members under Organization → Members. Admins can also send invitations and define Permission Sets there.

Roles

Role	What it allows
Owner	Everything an Admin can do, plus adding or removing other Owners and closing the Organization. An Organization always keeps at least one Owner.
Admin	Manage Organization settings, billing, members, invitations and Accounts. Admins have full access to every Account.
Member	Use the Accounts they have access to.

Changing a member to or from Owner asks for the exact Organization name.

Account Access

A Member has one of two access shapes:

Selected accounts: access only the Accounts with a direct grant. Each grant carries its own role and permissions, so one person can be an Account admin in staging and read only in production.
All accounts: access every current and future Account in the Organization, with one permission choice applied everywhere.

Either shape uses the same permission choices as API tokens:

Full access: every permission for that Account. For a Member, that covers the Account’s resources but not money: Billing needs Billing named in a custom permission choice.
Read only: read permissions for current and future resources.
Custom: exactly the permissions you pick, ideally saved as a Permission Set so several people share one audited definition.

Billing Access

Billing is an Organization privilege, separate from working in an Account:

Invoices, the payment portal and the billing email need Organization billing access: an Owner, an Admin, or a Member with All accounts access whose permissions include Billing.
A Member with a direct Account grant that names Billing sees that Account’s usage, limits, alerts, summaries and CSV only. Full access or Read only alone does not show a Member money; their menus leave Billing out.

To give a finance teammate the bill without making them an Admin, add them as a Member with All accounts access and a custom permission choice limited to the Billing group. API tokens follow the same rule through the token’s user.

From The CLI

blossom organization:member:list
blossom organization:member:init

writes member.yml:

member:
  role: member
  # Use all for every current and future account.
  # Use selected when this member should use only the accounts below.
  account_access: all
  permission_set_id: read_only
  # ...

blossom organization:member:update --id organization_user-100 --data member.yml
blossom permission_set:list

See the member update reference for the member.yml shapes and the Permission Set commands.