Admin and Member roles for organization members

Organizations now have two roles: Admin and Member. Only Admins can invite a teammate (and pick their role), revoke a pending invitation, remove a member, or change anyone's role, including their own. Members can still see the full member list and pending invitations, and can leave the organization themselves at any time, but no longer see the controls to manage other people's access.

The person who creates an organization becomes its first Admin.

An organization can't be left without an Admin: you can't remove or demote the last one, including by leaving if you're the only Admin left.

⚠ Existing organizations aren't migrated by this change: their members keep whatever role WorkOS assigned by default until someone is manually promoted to Admin.

See Members for the full walkthrough.