Members

A user is a global identity in LakeSail (one email, one set of credentials). A member is the org-scoped link between that user and your organization. Audit trails and role assignments are tracked against the member rather than the user, so the same person can belong to multiple organizations without conflicts.

This page covers the member lifecycle and the account-type distinction that determines who controls a member's profile.

How someone becomes a member

An Owner sends an invite from Settings → Members. The invitation creates a pending membership. The invitee completes signup, verifies their email, and accepts the invitation to become an active member. See Invite teammates for the steps.

SSO does not create or activate memberships. A person must accept their invitation before using SSO, and their primary LakeSail email must match the identity provider's email claim. See Single sign-on.

Account types

Every member has an accountType, which determines who controls the user's profile.

Type	Who controls the profile	Right for
managed (default)	The organization	Employees. Owners can reset passwords, reset MFA, and deactivate the account.
external	The user themselves	Consultants, contractors, partners. Owners can grant access but can't change profile fields.

managed is the default for invited members. Pick external deliberately when the person isn't part of your org. This prevents accidental actions like resetting their password from the wrong direction.

What a member can do

A member's permissions come from two sources:

1. Organization roles assigned directly to the member (see Roles & permissions).
2. Team roles for each team the member belongs to (additive across teams).

Use an organization role for organization-wide access and a team role for one team's resources.

Manage members

From Settings → Members:

• Search and filter: find members by name, email, status, or role.
• Edit: update profile fields (managed only), change account type, toggle enabled.
• Reset MFA: if a member loses their 2FA device, an Owner can reset it (managed only). The member re-enrolls on next login. See MFA for the reset flow and identity-verification caveats.
• Reset password: Owners can issue a password reset email (managed only).
• Disable / re-enable: turning isEnabled off blocks access without deleting the record. Past activity stays attached.
• Remove: deletes the member from the organization. Past activity stays attached for audit; the underlying user (if external) keeps their account.

Leaving an organization

A member can be removed by an Owner or, in some configurations, can leave on their own. Either way:

• The member loses access immediately.
• The user record stays. They keep their LakeSail login and any membership in other orgs.
• Resources the member created (jobs, queries, sessions) stay attached to the member ID for audit, but new activity from them stops.

Self-service

Members manage their own profile via Account settings:

• Update name and avatar.
• Manage email addresses (add, set primary, remove).
• Configure or reset their own MFA.
• Change password.

For managed accounts, profile fields like name and email may be controlled by the org. The self-service form shows what's editable.

API reference

• Members: list, describe, update, remove.
• Users: global user account management and self-service profile.
• Invitations: invite flow.
• MFA: Owner reset and self-service MFA.