Invite and manage custom group membership

Invite a person into an existing custom group, then check that they joined. You can also add an existing person or Agent Identity to a custom group. Identity explains why a group grants access but never acts.

Before you invite someone

You need profile:manage_member on your Tenant and authority to confer the selected group’s permissions. The Dashboard invitation form lists custom groups, not the platform-supplied tiers. Choose a group whose access the invited person needs, and review its assigned policies under Access Groups.

If no suitable custom group exists, open Access Groups > New group, enter a name, and choose Create group. You need profile:manage_group on group:<name> and aal2. Confirm that the group’s settings open, then assign its intended policies before inviting anyone into it. A new group has no assigned policies. If you cannot create the group or assign its policies, ask your Tenant’s technical owner to complete that setup.

Invite a person into a custom group

1. Open Team Members and choose Invite Member.
2. Enter the person’s email address and select at least one custom group. Choose Create Invitation.
3. Copy the invitation link from the result while it is visible. The invitation is created even if email delivery fails, so do not treat creation as proof that the person received the message. If needed, share the link with that person through a trusted channel. The link contains a one-time credential and expires after four hours.
4. Ask the person to open the link, sign in when prompted, and accept the invitation. Check Team Members to confirm they joined, then check the selected group’s Members tab for their membership.

If the link is missing and the person has not received the email, stop before creating another invitation. Ask your Tenant’s technical owner to check the pending invitation through their Profile API integration and resend it, or revoke it before creating a replacement. The Dashboard has no outgoing-invitation management view. A successful resend replaces the old link; use only the replacement and confirm that the person can accept it. A second creation request for an address with a pending invitation can be refused as a duplicate.

If acceptance is refused, check that the person’s account has the invited email verified and that the invitation has not expired. If both are valid, ask the inviter to review their authority to grant the selected groups.

Change membership in an existing custom group

To add a person who already belongs to the Tenant, or an Agent Identity, open Access Groups, choose the custom group, then open Members > Add Member. Select the identity and confirm. This change requires profile:manage_group on that group and authority to confer its permissions. Check that the identity appears in the group’s member list.

To remove a member, use the action on that same list with valid aal3 authentication, and check that the identity disappears. Removal takes away this group’s contribution, but another group or a direct policy can still allow the same operation. Check the intended operation and a neighboring operation after the authorization propagation window.

To change a supplied human tier, use the Profile API with profile:manage_tier; the Dashboard has no tier editor. Default policies owns the tier rules and review steps.