> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nasiko.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting up an organization

> Create departments, teams, and users, and grant them agent access with the admin CLI.

Nasiko models an organization as a hierarchy: **departments** contain **teams**, teams contain **users**, users hold a **role**. Separately, **agent grants** control which agents a user, team, or department can reach.

<Warning>
  **Enterprise feature.** Org hierarchy — departments, teams, roles beyond a single flat account
  list — is provisioned and managed entirely through `nasiko-ee`. The open-source edition has no
  departments, teams, or roles; every user is simply an authenticated account. Nothing on this
  page applies to a `nasiko`-only (OSS) install.
</Warning>

<Note>
  This page uses the platform admin CLI (`nasiko-ee`), not the developer CLI (`nasiko`). See [CLI installation](/cli/setup) and [access control](/onboarding/acl/overview).
</Note>

## Roles

| Role                 | Scope                                                 |
| -------------------- | ----------------------------------------------------- |
| `admin`              | Users, teams, and departments across the organization |
| `department_manager` | Teams and members in their department                 |
| `team_lead`          | Secrets and membership in their team                  |
| `team_member`        | Contributor on a team                                 |
| `member`             | Baseline user — can deploy and operate agents         |

Deploying requires `member`. Managing secrets requires `team_lead`. Managing users requires `admin`.

Managing multiple control planes? Most commands accept `--deployment <name>`, or set a default with `nasiko-ee use <name>`.

<Steps>
  <Step title="Create a department">
    ```bash theme={null}
    nasiko-ee department create --name Engineering --description "Product engineering"
    ```

    Prints the department ID. Assign a manager with `nasiko-ee department update <dept-id> --manager <user-id>`.
  </Step>

  <Step title="Create a team">
    ```bash theme={null}
    nasiko-ee team create --name Backend --dept <dept-id> --description "Backend services team"
    ```

    Add `--lead <user-id>` now or later with `nasiko-ee team update <team-id> --lead <user-id>`.
  </Step>

  <Step title="Create users">
    ```bash theme={null}
    nasiko-ee users create \
      --username alice \
      --email alice@example.com \
      --role team_lead \
      --team <team-id>
    ```

    `--role` defaults to `member`. `--team` also sets the user's department; use `--dept` to place someone in a department without a team.

    There's no `--password` flag. The control plane prints a one-time access key and secret; the secret is the initial login password. Capture it — it isn't retrievable.

    Move users later: `nasiko-ee users place <username> --team <team-id>` (or `--dept`, or `--clear`).
  </Step>

  <Step title="Grant agent access">
    Role and team membership grant no agents by default. Grant explicitly:

    ```bash theme={null}
    nasiko-ee access grant <agent-id> --user alice
    nasiko-ee access grant <agent-id> --team <team-id>
    nasiko-ee access grant <agent-id> --dept <dept-id>
    nasiko-ee access grant <agent-id> --public
    ```

    `--user`, `--team`, and `--dept` accept multiple values and combine in one call. Revoke with `nasiko-ee access revoke`.

    To set an agent's *owning* team or department (not a grant):

    ```bash theme={null}
    nasiko-ee access org <agent-id> --team <team-id> --dept <dept-id>
    ```
  </Step>
</Steps>

## Inspecting

```bash theme={null}
nasiko-ee department ls                    # list departments
nasiko-ee department members <dept-id>     # who's in a department
nasiko-ee team ls --dept <dept-id>         # teams in a department
nasiko-ee team members <team-id>           # who's on a team
nasiko-ee access ls <agent-id>             # resolved users + grants
nasiko-ee access visibility <agent-id>     # public? every raw grant row
nasiko-ee access my-agents                 # agents you can access
```

## UI and API

The same operations are available in the admin UI and the `/api` org routes. See [user management](/onboarding/acl/user-management) and [user-to-agent access](/onboarding/acl/user-agent).

<Tip>
  Importing users from an identity provider? See [Entra ID and SSO](/platform/secret-manager/entra-id).
</Tip>