Organization members

Every Zeon user belongs to one organization (org for short). Nearly all of what you do (creating projects, running workflows) concerns only you. But your org admin can see the org's members and manage roles.

If you're a regular member

You'll only see two things in the account app's nav: Profile and API tokens. The Members page is hidden. It's an admin-only view.

What this means in practice: you can use Zeon normally, but you can't see other people in your org or invite new ones. To get someone added, ask your org admin.

If you're an org admin

Org admins see an extra Members entry in the nav. The page lists everyone in your org with:

You can:

• Invite a new member: click Invite user. Provide their email and pick a role (member or admin). Zeon sends them an invitation email with a temp password; they finish setup on first sign-in.
• Open a member's detail. Click a row to see their user-detail page.
• Change a member's role. On the user-detail page, switch them between member and admin. You can't change anyone's organization from this view; that's a Zeon-staff operation.
• Disable a member: same page, Disable button. This stops new sign-ins. It does not revoke their API tokens or end a session already in progress. See What disabling actually does.
• Re-enable a disabled member: same page, Enable button.

What admins can't do

A few guardrails:

• You can't disable yourself. Need to lock your own account down? Ask another admin in your org, or contact Zeon staff if you're the only admin.
• You can't modify Zeon staff accounts that happen to be cross-listed in your org (rare, but possible during onboarding).
• You can't change someone's organization. Moving users between orgs is a Zeon-staff action.
• You can't see other orgs' members. Each org's membership is private to that org.

How invitations work

When you invite a user:

1. They get an email from Zeon's identity service with a one-time password and a sign-in link.
2. On first sign-in, they're prompted to set their own password.
3. Once signed in, they land on their profile page, and they're a member of your org from that point on.

If they don't get the email, check spam first. If it's not there, ask them to use Forgot password? on the sign-in page. That re-triggers the password-set flow.

What disabling actually does

When you disable a user:

• They can't start a new sign-in.
• Their existing browser session keeps working until its token expires, up to 60 minutes. Disabling blocks the refresh, but it can't reach in and kill a token that's already issued.
• Their existing API tokens keep working, indefinitely, until each one expires or is individually revoked. Disabling only touches the account; it never touches token records.

When you re-enable them:

• They can sign in again with their previous password.
• Their old API tokens are still valid, because they were never revoked.

Offboarding or responding to a compromise

Disabling is a good "freeze" for an account someone has stopped using, and you keep their work, projects, and commit history. It is not sufficient when the concern is security. In that case:

1. Get their API tokens revoked. This is the step that actually cuts off access, and it is the one you cannot do yourself. The API tokens page is strictly self-service: it lists and revokes only your own tokens, and a member's user-detail page has no token view. Either have the user revoke their own tokens at https://zeonsystems.app/account/api-tokens while they can still sign in, or (if they can't, or the account is compromised) contact Zeon staff to revoke them for you.
2. Disable the account, to stop new sign-ins.
3. Allow up to an hour for any live browser session to expire.

Do these in that order. Revoking tokens closes the path that stays open longest, and disabling first would lock the user out of the page they need to revoke from.

Audit trail

Every admin action on a user (invite, role change, disable, enable) is logged. Regular org admins don't see the log; Zeon staff can if needed for troubleshooting.

Where to go next