Team & Access

You will finish this page able to bring your team in, give each person exactly the right permissions, and show an auditor who did what.

Organizations

Your organization is the tenant boundary. Projects, findings, scans, BOMs, credits, API keys and the audit log all belong to one organization and never cross into another.

Rename it at Settings → General → Organization Name. Only Admins can.

Organization logo

Settings → General → Organization Logo. Three ways to set one:

• Use my website's logo: Argus re-fetches it from your email domain.
• Use URL: paste an image URL. Argus fetches and validates it, then stores it, so the logo never breaks when the source moves.
• Remove: clears it. Your organization initials are used instead.

Belonging to more than one organization

You can be a member of several organizations, a personal one and your employer's, or several clients. One is active at a time; everything you see belongs to the active organization.

Switch with the organization picker in the top navigation. Your role can differ in each.

{ MyOrganizations { orgId name role plan isActive } }

mutation { SwitchOrganization(orgId: "<org-id>") { status message } }

Roles

Argus has three assignable roles plus one machine principal. The roles are fixed. They are defined in the application, which is what makes them enforceable. There is no custom-role builder.

New users default to Developer.

Permission matrix

Every write in Argus is checked against this matrix on every request. Reads are available to any authenticated member of the organization.

Three details worth knowing:

• A Viewer holds exactly one write: their own account preferences. They cannot delete a project, trigger a scan, or change a finding.
• An API key cannot delete a project, and cannot change its owner's password or accept invitations. A leaked CI token is contained.
• Anything not explicitly permitted is denied. A new capability ships locked, not open.

Blocked actions return a clear message: Your role (viewer) is not permitted to perform this action.

See the full matrix live, per role, at Settings → IAM → Roles.

Changing someone's role

Settings → IAM → Users → Edit on the member's row. Pick Admin, Developer or Viewer; the role's description renders under the picker so you can see what you are granting. Role changes take effect on the member's next request. There is no session to wait out.

Inviting teammates

1. Settings → IAM → Users → Invite User.
2. Enter the email address and pick the role.
3. Send Invitation.

If email delivery fails, Argus tells you plainly and gives you a Copy link button carrying the accept URL. It never claims an invitation was sent when it was not.

Pending invitations appear above the members table, each showing the email, role, and days remaining. Resend or revoke from there. Re-sending issues a new link and invalidates the previous one.

The invitee opens the link, signs in or signs up, and joins your organization at the role you chose.

Joining by verified domain

Let anyone with an email at a domain you own join without an individual invitation.

Settings → IAM → Domains (Admins only).

1. Add the domain, for example acme.com. Public email providers such as gmail.com and outlook.com are refused: anyone could join.
2. Argus shows a TXT record name and value. Publish it in your DNS.
3. Click Check DNS record. Argus resolves the record; a domain is only marked Verified once it genuinely resolves. A pending result is reported as pending, never as success.
4. Turn on Let anyone with a @domain address join without an invitation.
5. Choose the role new joiners get: Viewer or Developer.

Admin cannot be granted automatically, promote someone after they join.

Remove a domain at any time to close the door.

Removing a member

Settings → IAM → Users → Remove on their row, then confirm. They lose access immediately. This cannot be undone.

Account security

Settings → Security.

Password

Set or change your password. Minimum 12 characters: length is what matters; there are no symbol or capital-letter requirements.

If you sign in with Google, your account has no password yet. Setting one lets you also sign in with email and password.

Changing your password signs out every other session immediately. The tab you changed it in stays signed in.

Two-factor authentication

Argus supports TOTP two-factor authentication.

1. Click Enable two-factor.
2. Scan the QR code with Google Authenticator, 1Password, Authy or similar. A manual key is shown if you cannot scan.
3. Enter the 6-digit code and click Verify & enable.
4. Save your backup codes. Each works once if you lose your authenticator, and they are never shown again.

Once enabled, the card shows an ENABLED chip and a Disable two-factor button.

If your workspace has not turned on the authenticator factor yet, Argus says so explicitly rather than failing silently.

SSO / SAML is coming soon. There is no service-provider endpoint to register with an identity provider today.

Audit log

Settings → Security → Audit Log. Admin only.

Records security-relevant actions across your organization: role and key changes, policy and rule edits, project deletions, settings and billing changes, agent approvals, and every denied attempt, whatever it targeted.

Columns: Time · Actor · Action · Access · Outcome. The outcome pill reads Allowed or Denied. 20 entries per page.

Audited actions:

Routine self-service actions, marking a notification read, saving email preferences, asking the AI a question, are deliberately not recorded, so the log stays readable.

Audit logging is not retroactive. Only actions taken after it was enabled are recorded.

Read it from the API:

{ GetAuditLog(page: 1, limit: 50) {
    total
    entries { createdAt actorEmail action capability targetType targetId outcome }
} }

Email notifications

Settings → General → Email Notifications. These are per-account, not org-wide.

• Email alerts: the master switch.
• Minimum severity: Critical only · High and above · Medium and above · Low and above · Everything.
• Events: Scan completed · Scan failed · Fix pull request opened · Agent access request · Low credit balance.

Send test email delivers to your own address so you can confirm the pipe works. If email delivery is not configured on your deployment, the page says so, preferences still save, but nothing is sent.

Navigation preferences

Settings → Dashboard lets each person hide the sections and pages they do not use. Hiding is per-user and per-browser: nothing is deleted, and hidden pages stay reachable from the command palette and by direct link. Reset to defaults restores everything.

Next

• Billing and credits, plans and what consumes credits
• Policies and gates, what Admins can lock down