Members & Roles

Major provides granular access control at both the organization and application level.

Organization Roles

Creating connectors is its own permission. Builder and Admin have it, so their access doesn’t change. Without it, the Add connector button and the connector setup steps aren’t available. You can still sign in to an existing per-user connector.

Custom roles

Admins can define their own organization roles under Settings > Roles. The page lists the default roles (Member, Builder, and Admin, which can’t be changed) and your custom roles, with how many members hold each one. To create a role, click New role, give it a name, and choose its capabilities: A role with no capabilities can only view the apps shared with its members. A custom role never grants organization admin.

• Assigning a role: pick a custom role from a member’s role badge on the Members page, or from the member sheet. Picking a default role again replaces the custom role. The organization owner’s role can’t be changed.
• Inviting: a custom role can be chosen when you invite members.
• Auto-join: the role that new members get when they join through your email domain or SSO can be a custom role.
• Seats: a member with a custom role takes a Builder seat if the role can build apps, agents, and workflows or create connectors. Otherwise, they take a Member seat. Editing a role updates the seat of everyone who holds it.
• Moving members: you can move everyone who holds a role, plus its pending invitations, to another role.
• Deleting a role: choose the role its members and pending invitations move to. You can’t delete the role new members auto-join with. Pick a different auto-join role first.

Application Permissions

Each app has its own permission levels:

• Admin: Full control including sharing and deletion.
• Edit: Can modify the app in the editor and create new versions.
• View: Can run and use the deployed application.

Sharing Access

You can share access to your application with specific:

• Individuals: Invite users by email.
• Groups: Grant access to entire teams at once.

When an app admin invites people, the share dialog can also give them access to the app’s connectors, agents, and workflows. Check Also share access to N related objects to grant them. The list shows, for each invitee, only the objects they can’t use yet, and the role each one grants: This is optional and applies to individual users, not groups. Objects you aren’t an admin of can only be shared by their admins. On the Enterprise plan, admins can also block every app in the organization from being made public. See Disabling public apps.

Agent and Skill Permissions

Agents and skills have their own roles. See Agent access.

Resource Permissions

Resource permissions control who can use connectors and at what level:

Sharing Access

You can share access to connectors with specific:

• Individuals: Invite users by email.
• Groups: Grant access to entire teams at once.

Inviting Members

Go to Settings > Members and click Invite Members to open the invitation dialog. You can:

• Paste multiple email addresses at once (comma or newline-separated)
• Select a role to assign to all invitees
• Send batch invitations

The dialog shows real-time progress for each email address (pending, sending, success, or failed) and displays a summary when complete. Email addresses are deduplicated automatically, and validation errors appear inline if needed.

Accepting an Invitation

When you receive an invitation and sign up as a new user, your account is added to the organization with the role specified in the invitation:

• Google or Microsoft sign-in: you’re added as soon as you sign up.
• Email and password: you’re added once you verify your email address. After signing up, Major shows a verify-your-email screen. Click the link in the verification email, and you’re added to the organization and taken back to your invitation.

Joining your company’s organization

Each company gets one organization on Major. If you sign up with a work email and your email domain already belongs to an organization, you don’t get a new organization of your own:

• If that organization has domain auto-enrollment turned on, you’re added to it automatically. If you sign up with an email and password, this happens once you verify your email address.
• Otherwise, you see a page saying the organization is already on Major. Ask your organization’s owner or an admin to invite you, then accept the invitation.

An organization’s domain is the domain set on the organization. If none is set, it’s the domain of its owner’s verified email address, or an admin’s if the organization has no owner. Personal email providers such as Gmail and Outlook never count as a company domain. If your company isn’t on Major yet and you sign up with an email and password, Major creates your new organization once you verify your email address.

Groups

Groups allow you to manage permissions for sets of users efficiently.

• Inheritance: All members of a group inherit the permissions granted to the group.
• Default Permissions: Groups can be configured to have default permissions (e.g., View) on all new apps created in the organization.
• Group Settings: Access group details, manage members, view applications and connectors through the group settings page. The Members, Details, Applications, and Connectors tabs display all associated data for your group.

Creating Groups

The Create Group button in Settings > Groups is visible to all users. Admin users (those with canCreateApplications permission) can create groups. Non-admin users see the button disabled with a tooltip that says “Only organization admins can create groups.”

Managing Group Members

Organization admins can add both organization members and pending invitees to groups. When you add a pending invitee to a group, they automatically become a group member once they accept their organization invitation. The group members page displays all members with their status:

• Active members show their name and email
• Pending members (invitees not yet accepted) display a “Pending” badge

When inviting users to a group, the add-members dialog shows both current organization members and pending invitees, letting you pre-add invitees before they join.

All Users Group

Every organization includes a special All Users group containing every member of the organization.

• By default, this group is set to have View permissions on every new app, making internal tools open-by-default within the company.
• You can modify this setting if you prefer a more restrictive default.

All Builders Group

The All Builders managed group automatically syncs membership based on organization role - anyone with Builder role or higher is included.