Organization & User Management

Configure your organizational structure, manage teams, and control user access across Safeguard.sh products.

Organization Structure

Overview

Safeguard.sh uses a hierarchical structure:

Tenant
└── Organization(s)
    └── Project(s)
        └── Version(s)

Tenant

The top-level container for your company:

• Single billing entity
• Global settings
• SSO configuration
• API key management

Organizations

Logical groupings within your tenant:

• Separate business units
• Different teams
• Project portfolios
• Access boundaries

Projects

Individual software projects:

• SBOM generation targets
• Security scanning units
• Policy application scope

Managing Organizations

Creating an Organization

1. Go to Settings → Organizations
2. Click + New Organization
3. Enter details:

4. Click Create

Organization Settings

Configure per-organization settings:

Deleting an Organization

1. Go to organization settings
2. Click Delete Organization
3. Confirm deletion (this removes all projects)

User Management

User Roles

Role Permissions Matrix

*Within assigned organizations

Inviting Users

1. Go to Settings → Members
2. Click + Invite Member
3. Enter:

4. Click Send Invitation

Managing Members

The Members page shows:

• Member name and email
• Status (Active/Pending/Disabled)
• Role assignment
• Organization membership
• Last active date

Modifying User Access

1. Click on a user
2. Modify role or organizations
3. Save changes

Removing Users

1. Click on a user
2. Click Remove Access
3. Confirm removal

Teams

Creating Teams

Group users into teams for easier management:

1. Go to Settings → Teams
2. Click + New Team
3. Enter team name and description
4. Add team members
5. Assign organizations

Team Permissions

Teams can be assigned:

• Organization access
• Project access
• Notification preferences
• Policy ownership

Access Control

Project-Level Access

Control who can access specific projects:

1. Open project settings
2. Go to Access tab
3. Add users or teams
4. Set permission level

Permission Levels

SSO Integration

Automatic Provisioning

With SSO configured:

• Users auto-created on first login
• Group mappings assign roles
• Attributes set permissions

Group Mapping

Map SSO groups to Safeguard.sh roles:

1. Go to Settings → SSO → Group Mappings
2. Add mapping:

Audit Trail

User Activity Logs

Track user actions:

Viewing Logs

1. Go to Settings → Audit Log
2. Filter by user, action, date
3. Export logs as needed

API Access

# List users
curl -X GET https://api.safeguard.sh/v1/users \
  -H "Authorization: Bearer $API_KEY"

# Invite user
curl -X POST https://api.safeguard.sh/v1/users/invite \
  -H "Authorization: Bearer $API_KEY" \
  -d '{"email": "user@example.com", "role": "user", "organizations": ["org-id"]}'

# List organizations
curl -X GET https://api.safeguard.sh/v1/organizations \
  -H "Authorization: Bearer $API_KEY"

# Create organization
curl -X POST https://api.safeguard.sh/v1/organizations \
  -H "Authorization: Bearer $API_KEY" \
  -d '{"name": "Engineering", "description": "Engineering team projects"}'

Best Practices

Organization Design

• Align with business structure
• Keep hierarchy simple
• Plan for growth
• Document ownership

User Management

• Use SSO when possible
• Apply least privilege
• Review access regularly
• Remove inactive users

Security

• Enable MFA for all users
• Review audit logs periodically
• Document access policies
• Train users on security

Next Steps

• Configure SSO
• Policies & Gates
• Portal User Roles