Roles
Every member has one of three roles:Add people
Add teammates on the People page as admins or members, and Passport emails each an invite. You can also copy your workspace sign-in link and share it directly. A person’s team is stored as their department; assign it when you add them or change it later. Activity export filters use the query parameterdepartment for that team name.
Members can be searched and filtered by team, role, or account status. Open a person to jump to their filtered audit trail or edit their title, team, and role. Profile changes remain a draft until you select Save changes; closing the panel discards them.
Manage teams
Teams live alongside People. Each team card shows its members, with direct actions for membership, activity, rename, and deletion. Renaming a team carries its access rules forward. Deleting one asks where its people should move before removing the team’s shared rules.Who can join
Free and Pro workspaces stay invite-only: only invited members can sign in. Domain join and domain discovery are Enterprise controls under workspace Settings. On Enterprise, joining defaults to invite-only. You can instead allow anyone who verifies an email on a company domain to join as a member (a Slack-style domain policy), and optionally make the workspace discoverable to teammates on those domains. You control this and the list of allowed domains in Settings.Consumer and disposable email domains never trigger domain join or domain discovery, so shared providers like gmail.com can never be used to walk into your workspace.
Deactivate and reactivate
Deactivating a member immediately signs them out everywhere and revokes their connected-account grants, so nothing sits at rest or re-arms later. Reactivating restores access; they reconnect their own accounts. Sign-in attempts by a deactivated member are recorded in the audit trail as a security signal.The same lifecycle runs through SCIM. Deprovisioning a user in your IdP does exactly this, and Passport refuses to remove the last active admin. See SCIM.
Agent identities
Agent keys are available to owners on every plan from Settings. On Free and Pro, expand Advanced and open Headless & CI (there is also a CLI guide link there). On Enterprise, Headless & CI is a top-level Settings card. Creating a key also creates a governed agent identity. Thepak_ bearer is shown once and stored only as a hash; its calls have their own access and Activity attribution, and revoking the key retires the identity. On Free, agents count toward the member cap; on paid plans they are not billed as seats.
Choose an identity model when you create the key:
Delegation can only narrow access: an app or tool unavailable to either principal is unavailable to the agent. The same intersection applies to tools, resources, prompts, connection status, bundles, and personal client selection. Activity and Runtime Security findings record both the agent and delegated person.
When a delegated person’s app sign-in is missing or expires, the agent can present a secure connection link bound to that person. The person completes sign-in directly in Passport and the agent can then retry. Autonomous agents do not receive these links because there is no human identity to bind them to; use a delegated identity, a normal member connection, or company-managed authentication instead.
Delegated keys require Enterprise and expire after 1–365 days. If the delegated person is deactivated, or the key expires or is revoked, authentication fails immediately. Create a replacement key to rotate it; the old bearer is never shown again.
Passport CLI accepts an agent key through
PASSPORT_AGENT_KEY with the governed workspace endpoint in PASSPORT_ENDPOINT (https://…/w/ws_…/mcp). This mode writes no local credential file, so it is the recommended attach surface for CI, cron, and headless jobs. See Passport CLI.