Members

A user is a global identity in LakeSail (one email, one set of credentials). A member is the org-scoped link between that user and your organization. Audit trails and role assignments are tracked against the member rather than the user, so the same person can belong to multiple organizations without conflicts.

This page covers the member lifecycle and the account-type distinction that determines who controls a member's profile.

How someone becomes a member

An Owner sends an invite from Settings → Members. The invitation creates a pending membership. The invitee completes signup, verifies their email, and accepts the invitation to become an active member.

Invite a member

1. Open Settings → Members and click Invite member.
2. Enter the invitee's Full name and Email.
3. Choose Full member or External member.
4. Select an Org. Role.
5. Add at least one Team and choose a Team Role for each.
6. Click Send.

The invitee receives an email with a link. After completing signup, they join your organization as a member. Invites are time-limited; if someone misses the window, re-send from the Members page to generate a fresh link.

After they accept, change their organization role here or their team membership and roles under Settings → Teams. See Roles & Permissions.

SSO does not create or activate memberships. A person must accept their invitation before using SSO, and their primary LakeSail email must match the identity provider's email claim. See Single Sign-On.

Account types

Every member has an accountType, which determines who controls the user's profile.

Type	Who controls the profile	Right for
managed (default)	The organization	Employees. Owners can reset passwords, reset MFA, and deactivate the account.
external	The user themselves	Consultants, contractors, partners. Owners can grant access but can't change profile fields.

managed is the default for invited members. Pick external deliberately when the person isn't part of your org. This prevents accidental actions like resetting their password from the wrong direction.

What a member can do

A member's permissions come from two sources:

1. Organization roles assigned directly to the member (see Roles & Permissions).
2. Team roles for each team the member belongs to (additive across teams).

Use an organization role for organization-wide access and a team role for one team's resources.

Manage members

From Settings → Members:

• Search and filter: find members by name, email, status, or role.
• Edit: update profile fields (managed only), change account type, toggle enabled.
• Reset MFA: if a member loses their 2FA device, an Owner can reset it (managed only). The member re-enrolls on next login. See MFA for the reset flow and identity-verification caveats.
• Reset password: Owners can issue a password reset email (managed only).
• Disable / re-enable: turning isEnabled off blocks access without deleting the record. Past activity stays attached. The member can no longer sign in, and their running sessions and notebooks are closed automatically shortly after.
• Remove: deletes the member from the organization. Past activity stays attached for audit; the underlying user (if external) keeps their account. Their running sessions and notebooks are closed automatically shortly after.

Leaving an organization

A member can be removed by an Owner or, in some configurations, can leave on their own. Either way:

• The member loses access immediately.
• The user record stays. They keep their LakeSail login and any membership in other orgs.
• Resources the member created (jobs, queries, sessions) stay attached to the member ID for audit, but new activity from them stops.

Self-service

Members manage their own profile via Account settings:

• Update name and avatar.
• Manage email addresses (add, set primary, remove).
• Configure or reset their own MFA.
• Change password.

For managed accounts, profile fields like name and email may be controlled by the org. The self-service form shows what's editable.

API reference

• Members: list, describe, update, remove.
• Users: global user account management and self-service profile.
• Invitations: invite flow.
• MFA: Owner reset and self-service MFA.