Users & Invitations
Membership in SixDegree is scoped to an environment. Every user has a role in each environment they belong to, and that role determines exactly what they can see and change.
Screenshot needed: Environment Members page. A table of users with columns for name, email, role (dropdown), last active, and a per-row Remove action. Top right has an Invite member button.
How membership works
A user can belong to many environments with a different role in each: admin in their team's dev environment, read-only in production, no access at all to another team's environment. There's no global SixDegree admin. Every permission check is scoped to one environment.
Your identity comes from your sign-in provider (Google, Microsoft, email/password). SixDegree controls what you can do inside an environment, not who you are.
Roles
Every user has one role per environment:
- Owner: full control of the environment, including managing members and deleting it.
- Admin: invite and remove members, change roles, and configure integrations.
- Member: use the agent and view entities and rules. Can't change environment settings.
Role changes take effect immediately. The affected user receives an email notification when their role in an environment changes.
Role changes are environment-scoped. Updating someone's role in one environment has no effect on any other environment they belong to.
Inviting someone
From the Members page, click Invite member and fill in:
- Email address: who you're inviting
- Role: what they'll be able to do once they accept
Click Send invite. The invitee receives an email with a one-click accept link. A pending invitation row appears in the dashboard until they accept.
Screenshot needed: Invite dialog with the email input, role dropdown showing options like Owner / Admin / Member, and a Send invite button.
Screenshot needed: The invitation email itself. Clean template with the environment name, who invited you, your role, and a large Accept invite button.
Bulk invitations
To invite a whole team at once, switch to Bulk invite mode in the same dialog. Paste a list of email addresses and choose one role for all of them. Each invitation is sent independently. If one hits a quota limit, the rest still go out.
What the invitee sees
The accept link opens a public preview page showing the environment name, who sent the invitation, and the assigned role, all before the invitee has to sign in. After signing in (creating an account if needed), one click on Accept adds them to the environment.
Screenshot needed: The public invitation preview page. Environment name, inviter's name and email, role badge, and an Accept invite button that becomes active after sign-in.
Managing pending invitations
From the pending-invitations list you can:
| Action | What it does |
|---|---|
| Resend | Sends the invitation email again without invalidating the original link |
| Revoke | Invalidates the invitation immediately. The accept link stops working |
Revoking an invitation does not delete the record. It is marked revoked and stays in the audit trail, so you can always answer who invited someone, when, and who revoked it.
Changing a member's role
Click the role dropdown next to any member's name on the Members page. The change takes effect immediately and the member receives an email notification.
Screenshot needed: Members table with a role dropdown open on one row, showing the available roles. A toast on the side reads "Role changed. [email protected] is now Admin."
Quotas
The user count applies toward your environment's Users quota. The quota check runs when an invitation is accepted, not when it's sent. So you can have more pending invitations than your quota allows.
If accepting would push the environment over the limit, the platform tells the invitee clearly and surfaces the same information to the inviter on their next visit.
Connector token expiry
When a molecule uses per-user OAuth (for example, you connected GitHub with your own GitHub account) the platform tracks when your token will expire.
| Timing | What happens |
|---|---|
| ~30 days before expiry | You receive an "OAuth expiring" email |
| On expiry | You receive an "OAuth expired" email; molecule pauses discovery and tool calls for your account |
| After re-auth | Full access resumes immediately |
Re-authorization is done from the Connected accounts section of your profile. Your colleagues' connectors are unaffected by your token state.
Emails the platform sends
| Trigger | |
|---|---|
| Invited to an environment | Invitation |
| Role changed | Role changed |
| Connector token nearing expiry | OAuth expiring |
| Connector token expired | OAuth expired |
| Environment or account deletion | Deletion notice |
| Data export ready | Data export ready |
| Agent task completes (opt-in) | Task completed |
| Agent task fails (opt-in) | Task failed |
Every send is logged. If someone reports a missing invitation, support can confirm whether it was sent and what the delivery status was.
Removing someone
Use the Remove action on a member's row to revoke their access to this environment. Their account isn't deleted and their membership in other environments isn't affected.
If the user being removed is the only member of the environment, removal is blocked. Delete the environment instead.
Next steps
- Molecules: how per-user OAuth connects integrations to individual accounts
- Environments: how environments are created and scoped