> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nasiko.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting up an organization

> Create departments, teams, and users, and grant them agent access with the admin CLI.

<Info>
  **Enterprise.** Org hierarchy is `nasiko-ee` only. The command list on this page is from the published Enterprise CLI surface; this checkout does not include the `ee/cli` source, so flag names were not re-verified against a binary in this pass.
</Info>

Nasiko models an organization as a hierarchy: **departments** contain **teams**, teams contain **users**, users hold a **role**. Separately, **agent grants** control which agents a user, team, or department can reach.

<Warning>
  **Enterprise feature.** Org hierarchy — departments, teams, roles beyond a single flat account
  list — is provisioned and managed entirely through `nasiko-ee`. The open-source edition has no
  departments, teams, or roles; every user is simply an authenticated account. Nothing on this
  page applies to a `nasiko`-only (OSS) install.
</Warning>

<Note>
  This page uses the admin CLI (`nasiko-ee`), not the developer CLI (`nasiko`). See [Install and connect](/install) and [access control](/governance/access-control/overview).
</Note>

## Roles

| Role | Scope |
| - | - |
| `admin` | Users, teams, and departments across the organization |
| `department_manager` | Teams and members in their department |
| `team_lead` | Secrets and membership in their team |
| `team_member` | Contributor on a team |
| `member` | Baseline user — can deploy and operate agents |

Deploying requires `member`. Managing secrets requires `team_lead`. Managing users requires `admin`.

Managing multiple Nasiko clusters? Most commands accept `--deployment <name>`, or set a default with `nasiko-ee use <name>`.

<Steps>
  <Step title="Create a department">
    ```bash theme={null}
    nasiko-ee department create --name Engineering --description "Product engineering"
    ```

    Prints the department ID. Assign a manager with `nasiko-ee department update <dept-id> --manager <user-id>`.
  </Step>

  <Step title="Create a team">
    ```bash theme={null}
    nasiko-ee team create --name Backend --dept <dept-id> --description "Backend services team"
    ```

    Add `--lead <user-id>` now or later with `nasiko-ee team update <team-id> --lead <user-id>`.
  </Step>

  <Step title="Create users">
    ```bash theme={null}
    nasiko-ee users create \
      --username alice \
      --email alice@example.com \
      --role team_lead \
      --team <team-id>
    ```

    `--role` defaults to `member`. `--team` also sets the user's department; use `--dept` to place someone in a department without a team.

    There's no `--password` flag. The server prints a one-time access key and secret; the secret is the initial login password. Capture it — it isn't retrievable.

    Move users later: `nasiko-ee users place <username> --team <team-id>` (or `--dept`, or `--clear`).
  </Step>

  <Step title="Grant agent access">
    Role and team membership grant no agents by default. Grant explicitly:

    ```bash theme={null}
    nasiko-ee access grant <agent-id> --user alice
    nasiko-ee access grant <agent-id> --team <team-id>
    nasiko-ee access grant <agent-id> --dept <dept-id>
    nasiko-ee access grant <agent-id> --public
    ```

    `--user`, `--team`, and `--dept` accept multiple values and combine in one call. Revoke with `nasiko-ee access revoke`.

    To set an agent's *owning* team or department (not a grant):

    ```bash theme={null}
    nasiko-ee access org <agent-id> --team <team-id> --dept <dept-id>
    ```
  </Step>
</Steps>

## Inspecting

```bash theme={null}
nasiko-ee department ls                    # list departments
nasiko-ee department members <dept-id>     # who's in a department
nasiko-ee team ls --dept <dept-id>         # teams in a department
nasiko-ee team members <team-id>           # who's on a team
nasiko-ee access ls <agent-id>             # resolved users + grants
nasiko-ee access visibility <agent-id>     # public? every raw grant row
nasiko-ee access my-agents                 # agents you can access
```

## UI and API

The same operations are available in the admin UI and the `/api` org routes. See [user management](/governance/access-control/users-and-teams) and [user-to-agent access](/governance/access-control/agent-access).

<Tip>
  Importing users from an identity provider? See [Entra ID and SSO](/governance/sso-and-scim).
</Tip>