Skip to main content
Everything you create in Managed Agents belongs to one organization, and your role decides what you can do there. This page explains the model, so you can predict exactly what a person or an API key can reach.

​
Tenants and organizations

  • Tenant. The top level of an account. The first time you sign in, Recursion creates a tenant for you and makes you its primary owner.
  • Organization. A separate space inside a tenant. Agents, environments, sessions, vaults, skills, and tags each belong to exactly one organization and are never visible from another.
  • Default organization. Every tenant has one, named Default. Every member of the tenant can reach it.
The console works in your tenant’s Default organization. API keys work there too: an organization-scoped key names it, and a tenant-scoped key reaches it with x-organization-id: default. See API keys.

​
Roles

Each member has one tenant role. Their access to each organization comes from that tenant role. As the primary owner of your tenant, you are Organization admin in its Default organization. The primary owner is the person the tenant was created for. There’s exactly one, and nobody can remove or demote them, including themselves.

​
What each organization role can do in Managed Agents

  • Read covers listing and viewing agents, sessions, transcripts, events, environments, vaults (never secret values), and cost.
  • Create covers creating resources and starting sessions. Testing an environment’s setup script also needs create, because it provisions compute.
  • An organization billing member has no Managed Agents access. The console shows them the Billing screen alone. See Billing.
The role is checked on every request, for people in the console and for API keys alike. A request your role doesn’t allow returns 403 forbidden. A request for an organization you can’t reach returns 404 not_found, so its existence isn’t revealed.

​
What can go wrong

​
Next steps

API keys

Create a key scoped to one organization or the whole tenant.

Billing

Buy prepaid credits and manage cards.

Security

See how organizations, sandboxes, and credentials are isolated.

Console

Find the screen for each task.