# Organisations

An organisation is your company's tenant in ATLAS. It has its own sign-in, email domains, people, roles and contract. Everything else you create lives inside it: spaces, projects, providers and keys. Other organisations can't see any of it.

## What an organisation holds

```mermaid
flowchart LR
    Org[Organisation] --> IdP[Sign-in<br/>your identity provider]
    Org --> Dom[Email domains]
    Org --> Mem[Members and invitations]
    Org --> Con[Contract]
    Org --> Tree[Spaces and projects]
    Mem --> Roles[Base role + additional roles]
```

ilionx creates your organisation, connects its sign-in and invites your first Owner. If your organisation has no Owner yet, ask your ilionx contact. Your Owners and Admins then manage their own people.

Each person belongs to exactly one organisation.

## Email domains

An email domain tells ATLAS which organisation's identity provider a person signs in with. Domains route people to the right sign-in. Where ATLAS manages roles, a person on a registered domain becomes a Member at their first sign-in. Where your identity provider manages roles, they need a mapped group.

Claiming a domain is a trusted act, so ilionx manages domains. ilionx verifies the domain and adds it to your organisation. To add or remove one, send your ilionx contact the domain (for example `example.com`) and tell them which organisation it belongs to. People whose email ends in an unregistered domain see the **Organization Not Recognized** page when they sign in.

When a domain is removed, ATLAS disables the people on it (it doesn't delete them) and cancels pending invitations for it. Adding the domain again restores access for the people who were disabled.

## Members and roles

Every member has one **base role** (Owner, Admin or Member). A member may also hold **additional roles** (Account Manager, Auditor). Additional roles add to the base role and never take anything away. Only an Owner can assign the Owner role, and an organisation always has an Owner.

Auditor is deliberately separate. It's the only role that reads what was said to a model. Owners and Admins don't see prompts and responses unless they also hold it.

For what each role can do, see [Roles and permissions](https://docs.atlas.ilionx.dev/reference/roles-and-permissions.md).

### Where roles come from

Your organisation chooses a role source. Either Owners and Admins assign roles in the web app, or your identity provider's security groups decide. With groups, roles are read-only in ATLAS. For sign-in and group mapping, see [Identity and access](https://docs.atlas.ilionx.dev/concepts/identity-and-access.md#where-your-roles-come-from).

## Contract and seats

Your contract records the commercial terms: seat limit, platform fee and any flat fee per request. Contract changes take effect on the first day of a month. They never alter requests that ATLAS already priced. For more information, see [Budget and cost](https://docs.atlas.ilionx.dev/concepts/budget-and-cost.md).

A **seat** is an enabled member plus any invitation that hasn't been accepted. When you reach the seat limit, new people can't join until a seat is freed or the limit is raised.

- **Free a seat** by removing or disabling a member, or withdrawing an unaccepted invitation.
- **Raise the limit** by asking your ilionx contact.

## Removing people

You can disable someone to lock them out without deleting anything. Their personal keys stop working, and their history stays. Re-enabling restores their access. Deleting a person is permanent. Their past usage stays in your reports under the name they had at the time.

## Related

- Concepts: [Identity and access](https://docs.atlas.ilionx.dev/concepts/identity-and-access.md), [Spaces](https://docs.atlas.ilionx.dev/concepts/spaces.md), [Projects](https://docs.atlas.ilionx.dev/concepts/projects.md), [Budget and cost](https://docs.atlas.ilionx.dev/concepts/budget-and-cost.md)
- Reference: [Roles and permissions](https://docs.atlas.ilionx.dev/reference/roles-and-permissions.md)
- Guides: [Manage organisation members](https://docs.atlas.ilionx.dev/guides/admin/organisations-manage-members.md)