Account & Settings How-To Guide

Managing Users and Roles

Last updated: September 6, 2026 9 min read Intermediate

You manage people in your account from two places. Invite and edit users from Account Users in the sidebar (General group), and build the roles that grant permissions from Roles and Permissions in the Settings menu (the gear icon in the top toolbar). A user can hold several roles, and their access is the combined permissions of those roles.

Inviting a user

Open Account Users from the sidebar General group.
Click Add User.
Fill in the details:
- Name: the person’s full name (required).
- Email: the address the invitation is sent to (required).
- Role: an optional free text job title such as IT Manager or Engineer. This is a label, not a permission role.
- Department: an optional department label.
Click Add User. An invitation is emailed to the address, and nothing is created for that person until they answer it, because joining an organization is their decision to make. Somebody who already uses ISO Mate joins your account when they accept. Where the address has no ISO Mate account yet, choosing a password from the invitation is what creates their account and joins them at the same time.

Until an invitation is answered it leaves no trace in your organization. There is no member to manage, no seat on your subscription, and no account in that person’s name, so the address stays free to sign up for ISO Mate independently in the meantime. Recipients can decline from the invitation email, and an invitation expires if it goes unanswered for 14 days. Declining and expiry both release the place the invitation was holding, so you do not need to chase an invitation to recover the room.

How many users your account can hold

There is a ceiling on how many users an account can hold. It counts current members plus any invitations you have sent that have not yet been answered, because an unanswered invitation is already holding a place.

An account with an active subscription is held to a high ceiling that no real team reaches, since every user you add is already billed for. An account without one, including an account on a trial, is held to a much lower ceiling of ten. Subscribing lifts it straight away, with nothing to request.

The Add User dialog shows how much of the allowance is in use before you fill it in, so you can see where you stand. If the ceiling has been reached it says so, and the message tells you whether to subscribe or to contact us.

Reaching the ceiling only stops you adding more people. It never affects those already in your account. If a subscription lapses and the lower ceiling starts to apply, every existing member keeps their access and none of your data is touched. If you need more room than the ceiling that applies to you, contact support.

One consequence is worth knowing. Because everybody joins at the moment they answer their invitation, one sent while you had room can be refused on acceptance if the account has reached its ceiling since. The invitation stays open rather than being used up, so it works once you make room.

Invitation limits

Separately from the ceiling above, invitations are rate limited so the invitation system cannot be used to send large volumes of unwanted email. Inviting people at a normal pace is never affected. The limit covers resending an invitation as well as sending a new one, and it allows around fifty invitations an hour for each administrator, and around one hundred an hour across the whole account.

If you are setting up a large team in one sitting you may reach the limit and see a message asking you to try again later. Nothing is lost when that happens. The invitations you have already sent are unaffected, and you can carry on once the hour has passed. If you need to invite a large group at once, contact support and we can raise the limit for your account.

Assigning roles to a user

Permission roles are assigned separately from the invite, so you can adjust access at any time.

In the Account Users list, find the person and click the roles action (the shield icon) on their row.
Select one or more roles to grant. A user can hold several at once.
Click Save. New permissions apply the next time the user loads a page.

Every account ships with two system roles, Admin and Basic, both carrying a System badge. Their definitions are fixed, so neither can be edited or deleted, but that is separate from who holds them:

Admin grants every permission in the account. You can assign and remove it like any other role, subject to the rules below.
Basic is the baseline every member holds automatically. Its checkbox is always ticked and cannot be cleared, because it is applied to every member of the account.

Who can grant which roles

You can only hand out access you already hold. If a role would grant a permission you do not have yourself, saving is refused and the reason is shown. In practice this means the Admin role can be granted by the account owner and by existing administrators, since they are the only people who already hold everything it confers.

You also need the Users: Update permission to change anyone’s roles. A role that grants it also grants viewing the organization’s roles, since choosing which roles to assign means reading that list.

The account always keeps an administrator

Removing the Admin role from the last remaining administrator is refused, so an account can never be left with nobody able to administer it. Give the role to someone else first, then remove it from the original holder.

You may give up your own Admin role while at least one other administrator remains. The dialog warns you before you save, because you will not be able to restore the role yourself afterwards. Another administrator can always grant it back to you.

Managing existing users

Review: the Account Users table shows each person’s name, email, role label, department, and assigned roles, with the account owner marked by an Owner chip.
Edit: use the edit action to update a user’s name, role label, and department.
Remove: use the remove action to take a user off the account. You cannot remove yourself or the account owner.
Bulk remove: select several users, then use Remove Selected to take them off the account together.
Export: use the Export menu to download the user list as CSV or PDF.

Transferring account ownership

Every account has exactly one owner, marked with an Owner chip in the Account Users table. The owner has unrestricted control: their access is not limited by roles at all, so no permission can be withheld from them. For that reason ownership is not something a role can grant, and only the current owner can move it.

As the owner, open Account Users.
Find the member you want to hand the account to and click the transfer ownership action on their row. It appears only for the owner, and only on other members.
Confirm the transfer, then confirm your identity when prompted.

The new owner is given the Admin role at the same time, so they keep full access if ownership ever moves on again. You keep your own roles, including Admin, and remain a member of the account.

Two things are worth knowing before you transfer. Only the new owner can transfer ownership back, so the change is not something you can reverse on your own. And because an account must always have an owner, a user who owns one cannot be removed from it or deleted until ownership has been transferred to somebody else.

A transfer can also be refused because of the receiving member’s own limit. One person can own up to ten organizations, so a member who already owns ten cannot accept another. Ownership stays exactly where it was if that happens, and either that member hands one of their own organizations on first, or you choose somebody else.

Creating a custom role

Open the Settings menu (the gear icon in the top toolbar) and choose Roles and Permissions.
Click Create Role.
Enter a name, for example Developer, QA Lead, or Project Manager, and an optional description.
Select permissions. They are organized into expandable groups so you can grant access one area at a time.
Click the save action to store the role.

Each area offers granular actions, most commonly View, Create, Update, and Delete, with some areas adding actions such as Export, Manage, or Execute. Selecting any action automatically includes View, since a user must be able to see records before acting on them.

A few permissions carry a prerequisite for the same reason, where one area cannot be used without reading another. Granting Users: Update also grants viewing roles, because assigning a role means choosing from the list of them.

As with assigning roles, you can only put permissions on a role that you hold yourself. Editing a role to add access you do not have is refused.

Permission groups

Reports: reporting dashboards and data exports.
Account and Administration: profile, account settings, users, roles, billing, notifications, and API tokens.
DevOps and Project Management: issues, sprints, releases, Definition of Done templates, issue templates, projects, and repositories.
Quality Assurance: features, user stories, test cases, test cycles, test executions, test environments, and QA metrics.
Compliance and Governance: frameworks, requirements, policies, controls, procedures, evidence, attestations, and risks.
Operations and Support: incidents.
Customization: custom objects, entries, and workflows.
Productivity: tasks, notes, and diagrams.
Communication and Collaboration: mailboxes, emails, calendar, contacts, chat, direct messages, and feedback.
Help Desk: tickets, canned responses, SLA policies, and auto assignment rules.
Sales: leads, opportunities, deals, pipelines, and products.

The exact groups you see depend on the features enabled for your account, so a group appears only when its area is available.

Editing and deleting roles

Open any custom role to change its name, description, or permissions. Changes take effect for everyone assigned to that role the next time they load a page.

The Admin and Basic system roles are read only. Their names, descriptions, and permission sets are maintained by ISO Mate and cannot be changed or deleted, which keeps Admin meaning full access and keeps the Basic baseline consistent for everyone. This applies to the role definitions only. Assigning the Admin role to a user is a separate action and is covered above.

Ready to set up your team? Start your free 14-day trial and invite your first users in minutes.