Everything to do with your team lives under Identities in the sidebar, which only organization admins can see. The people are on its Users tab. Where they can reach is on Settings → Spaces.
Roles
airlock has two roles.
Admin unlocks, specifically: creating and configuring integrations, editing tool policies, service accounts, the Rules page (allowed AI clients, network access, anomaly detection, the AI use policy), skill security, directory sync, organization settings, the instruction library, organization-owned skills, and access grants. Admins see and manage every space, private ones included, and can join any of them; joining a private space is recorded in the audit trail. Seeing is not using: an administrator uses a space's integrations, skills and agents in their AI chats only after joining it, like anybody else, and a paused or archived space stops everybody. See spaces and access scoping.
Promote or demote a member from Identities → Users. Note that directory sync never assigns the admin role: every synced user arrives as a regular member, so admins are always promoted by hand.
Membership states
A person you'll see on the Users tab is in one of these states:
Pending is the one that catches people out. When someone signs up with a corporate email domain that already has an airlock organization, airlock asks them whether to join your organization or create their own. If they ask to join, they become a pending member and see a "waiting for approval" screen until an admin approves them. If they create their own, it does not take your email domain, so later colleagues are still offered your organization. Personal email domains always get their own isolated organization.
Inviting your team
- Open Identities → Users.
- Under Invite Users, enter the person's email address and send the invitation.
- They appear under Pending Invitations until they sign in. From there you can resend the invitation or cancel it.
Seats
Your organization has a seat limit. You can see it on Settings → Organization as N / M seats used, and the Add User button is disabled once you reach it, with the message "Seat limit reached (N/M)."
An invitation counts against the limit, not just an active member: an unaccepted invitation holds a seat until you cancel it. A pending member, one who signed up and is waiting for approval, does not hold a seat until you approve them. If you're at the limit and expecting someone to join, cancel a stale invitation first.
Like the plan flag, seats are set by airlock rather than bought in-app. Contact us to raise the number. See Billing & Usage for the other limits.
Spaces
A space is how you manage people at scale instead of one at a time. It replaced the groups airlock used to have: your groups became spaces when you upgraded, keeping their names and their members.
- Open Settings → Spaces.
- Click New space, name it, and choose its access level.
- Add members.
A space is used in four places:
- A home: an integration or skill homed in a space is reachable by everyone in it, with no grant to maintain. This is the one to reach for first. An agent is the exception: it has a home like everything else, but it is reached only by its author, by administrators and by whoever is named on it. See Spaces.
- Approvals: assign a space as the approver for a tool, and any member of it can approve. See Approval Workflows.
- Access grants: scope an integration, skill, or agent to a space. See Access Control.
- Allowed AI clients: restrict a given AI client to specific spaces under Rules → Allowed AI clients. See Security.
Prefer a space over a list of individuals in all of them. Onboarding someone then becomes a single membership change rather than a sweep across every resource and every tool.
If you use directory sync, your identity provider's groups arrive as directory-managed spaces and their membership is kept in step, so access follows your directory automatically.
Offboarding
- Remove the user in airlock, using the trash icon on their row on the Users tab. This is permanent and cannot be undone. If you use directory sync, offboard them in your identity provider instead, which marks them Deactivated rather than deleting them. Either way their sign-in stops working and their live sessions are revoked.
- Revoke their personal API tokens if they had any. An admin can see and revoke every personal token in the organization from Settings → Security.
- Reassign their approvals. If they were the only approver on a tool, add someone else or those requests will sit pending.
Because removal is irreversible, prefer directory-sync deactivation when you have it. A returning colleague is then re-enabled in your identity provider rather than re-invited from scratch.