Everything to do with your team lives under Settings → Users, which only organization admins can see. The people are there; the groups you organise them into are on the Groups tab beside it.
Roles
Airlock has two roles.
Admin unlocks, specifically: creating and configuring integrations, editing tool policies, service accounts, the Security settings (allowed AI clients, network access, anomaly detection, skill security), the AI use policy, directory sync, organization settings, the instruction library, organization-owned skills, and access grants. Admins also bypass access scoping entirely.
Promote or demote a member from Settings → Users. Note that directory sync never assigns the admin role: every synced user arrives as a regular member, so admins are always promoted by hand.
Membership states
A person you'll see on the Users tab is in one of these states:
Pending is the one that catches people out. When someone signs up with a corporate email domain that already has an airlock organization, they join your organization as a pending member rather than founding their own, and they see a "waiting for approval" screen until an admin approves them. Personal email domains always get their own isolated organization.
Inviting your team
- Open Settings → Users.
- Under Invite Users, enter the person's email address and send the invitation.
- They appear under Pending Invitations until they sign in. From there you can resend the invitation or cancel it.
Seats
Your organization has a seat limit. You can see it on Settings → Organization as N / M seats used, and the Add User button is disabled once you reach it, with the message "Seat limit reached (N/M)."
An invitation counts against the limit, not just an active member: an unaccepted invitation holds a seat until you cancel it. A pending member, one who signed up and is waiting for approval, does not hold a seat until you approve them. If you're at the limit and expecting someone to join, cancel a stale invitation first.
Like the plan flag, seats are set by airlock rather than bought in-app. Contact us to raise the number. See Billing & Usage for the other limits.
Groups
Groups are how you manage people at scale instead of one at a time.
- Open Settings → Groups.
- Click New group, give it a name and, if you like, a description.
- Add members. A member can also be made an owner of the group.
A group is used in three places:
- Approvals: assign a group as the approver for a tool, and any member of it can approve. See Approval Workflows.
- Access grants: scope an integration, skill, or agent to a group, or grant a group an integration's shared credential. See Access Control.
- Allowed AI clients: restrict a given AI client to members of specific groups under Settings → Security. See Security.
Prefer groups over individuals in all of them. Onboarding someone then becomes a single membership change rather than a sweep across every resource and every tool.
Deleting a group removes its members from it, and removes every access grant and approval rule that names it.
If you use directory sync, your identity provider's groups appear on the Groups tab and their membership is kept in step, so access follows your directory automatically. The identity provider owns who is in a synced group: change its members there, not in airlock.
Offboarding
- Remove the user in airlock, using the trash icon on their row on the Users tab. This is permanent and cannot be undone. If you use directory sync, offboard them in your identity provider instead, which marks them Deactivated rather than deleting them. Either way their sign-in stops working and their live sessions are revoked.
- Revoke their personal API tokens if they had any. An admin can see and revoke every personal token in the organization from Settings → Security.
- Reassign their approvals. If they were the only approver on a tool, add someone else or those requests will sit pending.
Because removal is irreversible, prefer directory-sync deactivation when you have it. A returning colleague is then re-enabled in your identity provider rather than re-invited from scratch.