Skip to main content

​
User Management

Manage your team members, control access levels, and configure user permissions. All QuivaWorks plans include unlimited users at no additional cost.

​
Adding Users

Invite team members to collaborate on your QuivaWorks account.
1

Navigate to Users

Go to Account Management → Users
2

Click Invite

Click the “Invite” button
3

Enter User Details

  • Email address - Where the invitation will be sent
  • First and last name
  • Role - Select appropriate access level
Understanding roles →
4

Send Invitation

Click “Invite” to send the invitation email
Users will appear with “Invitation Pending” status until they accept. User Invitation Email
Unlimited Users: All plans include unlimited users at no extra cost. Add as many team members as you need.

​
User Roles

Choose the appropriate role based on what each user needs to do:

Root

Account owners onlyComplete control including account closureView permissions →

Admin

Team leads and ITFull management except account closureView permissions →

Billing

Finance teamManage billing and subscriptions onlyView permissions →

Developer

Technical teamBuild and deploy resourcesView permissions →

Monitor

StakeholdersView-only accessView permissions →
Always apply the principle of least privilege - assign the minimum role needed for each user to do their job effectively.

​
Managing Users

​
Updating User Roles

Only Root and Admin users can change roles.
1

Navigate to Users

Go to Account Management → Users
2

Select User

Click on the user’s email address
3

Change Role

Select the new role from the dropdown
4

Confirm

Click “Update Role”
Changes take effect immediately. Restrictions:
  • You cannot change your own role
  • Admins cannot modify Root user roles
  • Admins cannot assign the Root role

​
Suspending Users

Temporarily restrict access without deleting the account:
1

Find User

Navigate to Account Management → Users and click on user’s email
2

Suspend

Click the dot menu (⋮) → “Suspend”
3

Confirm

Confirm the suspension
What happens:
  • User cannot log in
  • All active sessions are terminated
  • User resources remain in the account
  • Can be reactivated by an Admin at any time
When to use:
  • Employee on extended leave
  • Temporary contractor work completed
  • Investigating potential security issue
  • Pending account transfer
View suspended users by filtering for “Suspended” status in user management.

​
Terminating User Sessions

Force a user to log out from all devices:
1

Find User

Navigate to Account Management → Users and click on user’s email
2

Logout

Click the dot menu (⋮) → “Logout”
3

Confirm

Confirm to terminate all sessions
Use cases:
  • User reports device stolen
  • Suspected unauthorized access
  • User forgot to log out on shared computer
  • Troubleshooting access issues
Users can also manage their own sessions in their personal settings.

​
Deleting Users

Permanently remove a user from your account:
1

Find User

Navigate to Account Management → Users and click on user’s email
2

Delete

Click the dot menu (⋮) → “Delete”
3

Confirm

Confirm the deletion
This action is permanent and cannot be undone.What’s deleted:
  • User’s personal settings
  • User’s sessions and API keys
  • User’s MFA settings
What’s preserved:
  • Resources they created (agents, flows, MCP servers)
  • All data remains accessible to the team

​
Recovery Codes

Admins can issue or view recovery codes for users who have enabled MFA.

​
Issuing New Recovery Codes

1

Find User

Navigate to Account Management → Users and click on user’s email
2

Issue Codes

Click the dot menu (⋮) → “Issue new recovery codes”
3

Confirm

Click “I Am Sure” in the dialog
4

Save Codes

Download, print, or copy the codes securely
When recovery codes are issued or viewed, the user receives a “Security Codes Viewed” email notification to alert them of the access.

​
Viewing Existing Codes

1

Find User

Navigate to Account Management → Users and click on user’s email
2

View Codes

Click the dot menu (⋮) → “View recovery codes”
Root user recovery codes cannot be viewed by anyone else, including Admins. Root users must store their recovery codes securely as they cannot be recovered if lost.

​
Resource Sharing

All resources (agents, flows, MCP servers) are shared across your entire account. All team members can access resources based on their role permissions.
How it works:
  • Resources are organized into collections within flows
  • Access is controlled by role, not by who created the resource
  • When a user is deleted, their resources remain accessible to the team
  • No per-user resource ownership or isolation
Role-based access:
  • Root/Admin: Full access to all resources
  • Developer: Can create, modify, and delete all resources
  • Monitor: Can view all resources (read-only)
  • Billing: Cannot access resources
Learn more about role permissions →

​
Best Practices

​
User Lifecycle Management

When adding new team members:
  1. Create account with appropriate role
  2. Send invitation email
  3. Verify they receive and accept invitation
  4. Confirm they enable MFA (required for Admin/Root)
  5. Provide onboarding documentation
  6. Review access after first week
Start with minimal permissions and increase as needed.
Monthly reviews:
  • List all active users
  • Verify each user still needs access
  • Check for unused accounts (no recent activity)
  • Confirm roles are still appropriate
Quarterly reviews:
  • Comprehensive audit of all permissions
  • Review role assignments
  • Update access based on job changes
  • Document why each elevated role is needed
When users leave your organization:Immediately:
  1. Suspend the user account
  2. Terminate all their sessions
Within 1 hour: 3. Delete all their API keysWithin 24 hours: 4. Review their resources for any needed handoff 5. Delete the user accountDocument:
  • Who left and when
  • What resources they managed
  • Who took over their responsibilities
Mandatory for Root and Admin:
  • Enable MFA immediately
  • Use passkeys when possible
  • Store recovery codes in password manager
  • Use strong, unique passwords
  • Review sessions monthly
Recommended for all users:
  • Enable MFA
  • Use password manager
  • Review active sessions regularly
Security best practices →

​
Role Assignment Guidelines

Typical structure:
  • 1 Root (founder/owner)
  • 0-1 Admin (if needed)
  • 2-4 Developers
Why: Small teams usually don’t need separate Billing or Monitor roles. Developers can handle most operational tasks.

​
Troubleshooting

Solutions:
  1. Check spam/junk folder
  2. Verify correct email address was entered
  3. Click “Resend Invitation” in user management
  4. Try different email address if corporate email blocks it
  5. Ask user to check email filters/rules
If still not received after 10 minutes, contact support.
Common causes:
  • You don’t have Admin or Root role
  • Trying to change your own role (not allowed)
  • Admin trying to change Root user (not allowed)
  • Admin trying to assign Root role (not allowed)
Solution: Ask a Root user or different Admin to make the change.
Why this happens:Active sessions don’t terminate automatically on suspension.Solution:
  1. Click on the user
  2. Use the “Logout” option to terminate all sessions
  3. Sessions expire after 24 hours maximum anyway
Unfortunately:Deleted users cannot be recovered. You’ll need to:
  1. Send a new invitation to the same email
  2. They’ll need to accept and set up a new account
  3. Re-enable MFA
  4. Their old resources remain accessible to the team
Security concern:Having too many Admins increases security risk.Recommendation:
  • Limit Admin to 2-5 people maximum
  • Review if all Admins still need that level of access
  • Consider downgrading some to Developer role
  • Document why each Admin role is necessary

​
User Management Checklist

​
New User Setup

  • Determine appropriate role (least privilege)
  • Send invitation with clear expectations
  • Verify invitation accepted within 48 hours
  • Confirm MFA enabled (if Admin/Root)
  • Provide onboarding documentation
  • Review access after trial period

​
Regular Maintenance

  • Monthly: Review active users list
  • Monthly: Check for inactive accounts
  • Quarterly: Audit role assignments
  • Quarterly: Verify elevated roles still needed
  • Annually: Comprehensive security review

​
User Departure

  • Suspend account immediately
  • Terminate all sessions
  • Delete API keys within 1 hour
  • Review and transfer resources
  • Delete user account within 24 hours
  • Document handoff and transition

Roles & Permissions

Detailed breakdown of what each role can do

Authentication

Set up MFA for your users

Sessions

Monitor and manage active logins

Security Overview

Complete security best practices