People and invitations
People in your organization sign in to the console to set things up, decide approvals or review what happened. Agents also act on their behalf. You manage them under Tools & agents → People, which only administrators can open.
Invite a person
- Open Tools & agents → People and click Invite person.
- Enter their Email and Name.
- Choose a Role and, for Approver or Auditor, the Environment it applies to.
- Click Send invitation.
They get an email with an invitation code and a link to the Accept your invitation page, where they enter the code and set their own password (at least 8 characters, with an upper and a lower case letter, a number and a symbol). Until then, their Status is invitation sent.
- The invitation code works once and expires after 72 hours.
- If the console says "The person was added, but the email could not be sent", the person exists but never got their code.
- Each email address can belong to only one account.
If your organization uses a company login, the person can instead accept by signing in with it: Sign in with your company login on the sign-in page, with the email address you invited. That first sign-in makes them active, and their invitation code stops working. When company login is required, that's the only way to accept, except for admins. See Company sign-in (SSO).
If the email went missing or the code expired, open the person's ⋯ menu and choose Send the invitation again. They get a new code, and earlier codes stop working. You can send it up to 3 times an hour.
Pending invitations count toward your organization's limit of people. See Usage and limits.
Roles
| Role | Scope | What they do |
|---|---|---|
| Administrator | The whole organization | Sets up Gateways, connections, tools, agents, policies, people and customer access in every environment. |
| Approver | One environment | Sees requests waiting for approval in that environment, with their exact values, and approves or rejects them. |
| Auditor | One environment | Reviews approvals, executions and the audit trail of that environment, including the exact values of requests, without deciding anything. |
Things to know:
- Administrators can't approve unless they're also an Approver in that environment. They also can't see the exact values of requests waiting for approval: only that environment's Approvers and Auditors can, and every view is recorded.
- Roles can change at any time. Open the person's ⋯ menu and choose Change roles. Tick Admin, and Approver or Auditor (or both) under each environment, then click Save roles. A person needs at least one role. Changes apply at once. Someone who becomes an Admin or Approver without a second factor is signed out, and sets one up at their next sign-in.
- Nobody can remove their own Admin role, and an organization always keeps at least one active Admin.
- Approvals need at least two people. The person an agent acts for, the agent's owner and whoever issued its token can never approve that agent's request. Make sure each environment has Approvers who aren't any of these.
See Organizations, environments and roles for the full picture.
User ids
The User id column shows each person's id, for example 0192c3a4-…. Agents need it: each call names the person it's for, in the X-Gatelion-On-Behalf-Of header, and that person must be in the agent's May act for list. See Agents and tokens.
An agent can't act for someone who hasn't accepted their invitation yet. Their calls are refused as on_behalf_of_not_allowed.
Require a second factor
Administrators and Approvers must always use a second factor when they sign in: an authenticator app code, a passkey, or a recovery code. Each person sets theirs up on the Account page.
To require it for everyone, including Auditors, open Settings and turn on Require a second factor for everyone under Organization. The People tab links there. People without one are asked to set it up at their next sign-in, and can't do anything else in the console until they have.
Turning it off again means only Administrators and Approvers must use one. See Sign-in security.
People who sign in with your company login use its multi-factor sign-in instead, and Gatelion doesn't ask for its own second factor after it.
Company login
If your organization uses a company login, the Status column shows "company login" under the status of each person who has signed in with it, or "company login or password" if they also have a password.
Their first company sign-in links their company account to their Gatelion account. If someone gets a new account at your company login, their next company sign-in is refused as linked to a different account. Open their ⋯ menu and choose Unlink company login. Their next company sign-in links whichever company account has their email address. Their current sessions continue.
Reset a member's second factor
If someone loses their phone or passkey and has no recovery codes left, an administrator can reset their second factor:
- Find the person on the People tab, open their ⋯ menu and choose Reset second factor.
- Confirm.
They're signed out everywhere. At their next sign-in they enter their password and set up a new second factor.
The choice appears only for active members who have a password, and never on your own row: nobody can reset their own second factor. If you're the only administrator and you lose yours, use one of your recovery codes, so keep them somewhere safe.
When someone leaves
Open the person's ⋯ menu and choose Remove access. The confirmation lists the agent tokens they issued and the agents they own. When you click Remove access:
- They're signed out at once and can't sign in again.
- Agent tokens they issued stop working, at every Gateway's next sync.
- Agents they own become yours. If those agents used tokens the person issued, issue them new tokens to keep them running. As their new owner, you can't approve their requests.
- Calls on their behalf stop. Agents that act for them are refused (
on_behalf_of_not_allowed) after the next sync. Remove them from those agents' May act for lists when you can. - Requests on their behalf are cancelled. Requests still waiting for approval, and approved ones that haven't started running, show as Cancelled in Approvals. The agent gets
rejectedwithperson_removed. - Their seat is freed in your organization's limit of people.
Their Status shows Access removed, and their roles can't be changed until you restore them. Their name stays in the audit trail and on past approvals. You can't remove your own access, or the last active Admin.
To bring someone back, open their ⋯ menu and choose Restore access. They get the same roles back and sign in as before, with their old password or company login. Someone who hadn't accepted their invitation yet shows as invitation sent again. Restoring takes a seat in your limit of people again. Revoked tokens stay revoked, and agents that moved to you stay yours.
Also make sure each environment still has enough Approvers.
If your organization uses a company login, removing someone there stops their new sign-ins, but not a session they already have open. Use Remove access in Gatelion too.
Related: Agents and tokens · Sign-in security · Company sign-in (SSO) · Decide approvals · Settings
Still stuck? Contact support from the console.