> ## Documentation Index > Fetch the complete documentation index at: https://docs.labelbox.com/llms.txt > Use this file to discover all available pages before exploring further. # Organizations and roles > How tenants, organizations, and roles decide what each person and API key can see and do in Managed Agents. Everything you create in Managed Agents belongs to one organization, and your role decides what you can do there. This page explains the model, so you can predict exactly what a person or an API key can reach. ## Tenants and organizations ```mermaid theme={"theme":"css-variables"} flowchart TD tenant["Tenant: your account's top level"] --> default["Default organization"] default --> resources["Agents, environments, sessions, vaults, skills"] ``` * **Tenant.** The top level of an account. The first time you sign in, Recursion creates a tenant for you and makes you its **primary owner**. * **Organization.** A separate space inside a tenant. Agents, environments, sessions, vaults, skills, and tags each belong to exactly one organization and are never visible from another. * **Default organization.** Every tenant has one, named **Default**. Every member of the tenant can reach it. The console works in your tenant's **Default** organization. API keys work there too: an organization-scoped key names it, and a tenant-scoped key reaches it with `x-organization-id: default`. See [API keys](/managed-agents/api-keys). ## Roles Each member has one **tenant role**. Their access to each organization comes from that tenant role. As the primary owner of your tenant, you are **Organization admin** in its **Default** organization. | Tenant role | Role in the Default organization | | ----------------- | -------------------------------- | | **User** | Organization user | | **Developer** | Organization developer | | **Billing** | Organization billing | | **Admin** | Organization admin | | **Owner** | Organization admin | | **Primary owner** | Organization admin | The primary owner is the person the tenant was created for. There's exactly one, and nobody can remove or demote them, including themselves. ## What each organization role can do in Managed Agents | Organization role | Read | Create | Update | Delete | | -------------------------- | ---- | ------ | ------ | ------ | | **Organization admin** | Yes | Yes | Yes | Yes | | **Organization developer** | Yes | Yes | Yes | Yes | | **Organization user** | Yes | No | No | No | | **Organization billing** | No | No | No | No | * **Read** covers listing and viewing agents, sessions, transcripts, events, environments, vaults (never secret values), and cost. * **Create** covers creating resources and starting sessions. Testing an environment's setup script also needs create, because it provisions compute. * An organization billing member has no Managed Agents access. The console shows them the **Billing** screen alone. See [Billing](/managed-agents/billing). The role is checked on every request, for people in the console and for API keys alike. A request your role doesn't allow returns `403 forbidden`. A request for an organization you can't reach returns `404 not_found`, so its existence isn't revealed. ## What can go wrong | Code or symptom | Cause | Fix | | ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------ | | `403 forbidden` on create, update, or delete | The role is **Organization user**, which can only read. | Use an account or key with the developer or admin role. | | `403 forbidden` on every Managed Agents request | The role is **Organization billing**, which has no Managed Agents access. | Use an account or key with the user, developer, or admin role. | | `404 not_found` naming an organization | The `x-organization-id` header names an organization you can't reach, or a different organization than an organization-scoped key's. | Send `default`, or omit the header for an organization-scoped key. See [API keys](/managed-agents/api-keys). | ## Next steps Create a key scoped to one organization or the whole tenant. Buy prepaid credits and manage cards. See how organizations, sandboxes, and credentials are isolated. Find the screen for each task.