Setting up an organization

Nasiko models an organization as a hierarchy: departments contain teams, teams contain users, users hold a role. Separately, agent grants control which agents a user, team, or department can reach.

Enterprise feature. Org hierarchy — departments, teams, roles beyond a single flat account list — is provisioned and managed entirely through nasiko-ee. The open-source edition has no departments, teams, or roles; every user is simply an authenticated account. Nothing on this page applies to a nasiko-only (OSS) install.

This page uses the platform admin CLI (nasiko-ee), not the developer CLI (nasiko). See CLI installation and access control.

Roles

Role	Scope
`admin`	Users, teams, and departments across the organization
`department_manager`	Teams and members in their department
`team_lead`	Secrets and membership in their team
`team_member`	Contributor on a team
`member`	Baseline user — can deploy and operate agents

Deploying requires member. Managing secrets requires team_lead. Managing users requires admin. Managing multiple control planes? Most commands accept --deployment <name>, or set a default with nasiko-ee use <name>.

Create a department

nasiko-ee department create --name Engineering --description "Product engineering"

Prints the department ID. Assign a manager with nasiko-ee department update <dept-id> --manager <user-id>.

Create a team

nasiko-ee team create --name Backend --dept <dept-id> --description "Backend services team"

Add --lead <user-id> now or later with nasiko-ee team update <team-id> --lead <user-id>.

Create users

nasiko-ee users create \
  --username alice \
  --email alice@example.com \
  --role team_lead \
  --team <team-id>

--role defaults to member. --team also sets the user’s department; use --dept to place someone in a department without a team.There’s no --password flag. The control plane prints a one-time access key and secret; the secret is the initial login password. Capture it — it isn’t retrievable.Move users later: nasiko-ee users place <username> --team <team-id> (or --dept, or --clear).

Grant agent access

Role and team membership grant no agents by default. Grant explicitly:

nasiko-ee access grant <agent-id> --user alice
nasiko-ee access grant <agent-id> --team <team-id>
nasiko-ee access grant <agent-id> --dept <dept-id>
nasiko-ee access grant <agent-id> --public

--user, --team, and --dept accept multiple values and combine in one call. Revoke with nasiko-ee access revoke.To set an agent’s owning team or department (not a grant):

nasiko-ee access org <agent-id> --team <team-id> --dept <dept-id>

Inspecting

nasiko-ee department ls                    # list departments
nasiko-ee department members <dept-id>     # who's in a department
nasiko-ee team ls --dept <dept-id>         # teams in a department
nasiko-ee team members <team-id>           # who's on a team
nasiko-ee access ls <agent-id>             # resolved users + grants
nasiko-ee access visibility <agent-id>     # public? every raw grant row
nasiko-ee access my-agents                 # agents you can access

UI and API

The same operations are available in the admin UI and the /api org routes. See user management and user-to-agent access.

Importing users from an identity provider? See Entra ID and SSO.

Getting Started

CLI

ADLC

Dashboard

Platform

MCP Gateway

MCP Hub

Agents in Artifact Registry

Roles

Inspecting

UI and API

​Roles

​Inspecting

​UI and API

Roles

Inspecting

UI and API