Organizations and access
The organization boundary, the four roles, and why access is enforced at the record level.
Every object in Auron belongs to exactly one organization: agents, conversations, records, knowledge stores, signals, toolkits, automations, action outcomes. That boundary is what tenant isolation is built on, and nothing crosses it.
A person can belong to several organizations, with a different role in each. Switching organization re-scopes everything they see.
Roles
| Role | What it can do |
|---|---|
| Owner | Everything, including transferring ownership and deleting the organization |
| Admin | Everything operational: configuration, administration, reports |
| User | Use agents, run sessions, post to the feed. Configuration screens are read-only |
| Guest | Read the organization and its conversations |
There is one owner at a time, and ownership can be transferred. Roles decide what kind of thing you can do.
Record-level access
Roles are only half of it. The other half is which records you can see, and that is granted per person or per team.
This matters because in practice the enterprise question is rarely "can this person use agents" and almost always "should this person see this account". Auron enforces it at the record, and access carries through everything attached: the sessions on that record, their transcripts, their signals, their summaries and their reports.
The consequences are visible in daily use. Two colleagues can open the same entity and see different rows, and the record count on an entity is a per-person number rather than the entity's total.
Teams
Teams group people so things can be attached to a group rather than to individuals: agents, skills, knowledge stores, and access to records. Setting teams up to mirror how work actually divides is what keeps access manageable as record counts grow.
Why it is built this way
Access checks that live at the entity level align with how organizations already think. Nobody maintains a permission matrix over individual transcripts; they know which team owns which accounts. Enforcing at the record, and inheriting from there, means the intuitive answer and the enforced answer are the same one.
Where this lives in the product
Members, roles and teams are managed in the console under Users and teams. Record access is granted under Access, which also answers the reverse question of who can currently see a given record. On the phone, see Roles and access and Who can see a record.