Users and organizations

User and organization administration is an in-product setting. It lives under Admin, applies at runtime, and never requires a chart change or a redeploy — on Helm or on Embedded Cluster alike.

Note

Platform administration is separate from organization membership and personal settings. Use Settings → Members to manage one organization and Account Settings for personal secrets or chat models.

Manage organizations

Use Admin → Organizations to view, create, or delete organizations across the deployment. When creating an organization, set its owner and maximum member count.

If the owner email has no account, Dreadnode creates the organization and active owner membership, then emails a one-time account setup link. The owner sets a password through that link and signs in to the organization you created. Account setup preserves the existing organization, workspace, roles, and credits instead of creating a second organization during onboarding.

Use Settings → General for changes that belong to one organization, such as its display name.

Manage users

Use Admin → Users to search across the deployment and inspect a user’s account state, organization memberships, and platform role.

From a user detail page, you can:

• verify an email address
• grant or revoke platform-admin access
• delete the account

You cannot change your own platform role or modify a platform owner’s role. Only a platform owner can revoke platform-admin access from another administrator.

Caution

Deleting a user removes the account from the deployment, not only from one organization. This action cannot be undone.

Protect signups

Use Admin → Security to:

• limit signups from one IP address within a 24-hour period
• block signup traffic from specific IPv4 or IPv6 CIDR ranges
• allow signup traffic only from specific IPv4 or IPv6 CIDR ranges
• allow or block individual disposable email domains

The signup IP policy defaults to Deny configured networks. Select Allow only configured networks to require every self-service email or OAuth signup to match an allow rule. Deny rules remain active in both modes and take precedence when an address matches both lists. Requests that pass the network policy still count toward the rolling 24-hour signup limit.

Caution

Allow mode with no allow rules blocks every self-service signup, including requests whose client IP cannot be resolved. Admin-provisioned accounts remain available for recovery. Add an allow rule or switch back to deny mode to reopen self-service signup.

Related

• First admin account — claiming platform ownership on a fresh install
• Authentication and email — SMTP, OAuth providers, and signup policy