Roles & permissions

AwkTeams uses role-based access to control who can manage billing, integrations, and team settings.

Roles

The person who creates the account is the owner. Each account has one owner; admins are scoped to the teams they manage.

Adding team members

Console access is by invitation. Signing up with a work email on the same domain does not, on its own, add you to an existing account — the owner has to invite you.

The owner invites admins from Admins → Members and scopes each one to the teams they will manage.

Removing members

The account owner can remove or suspend members from the console. When a member is removed:

• →P.Chief stops acting for them
• →Their stored OAuth grants (Gmail, Calendar, Microsoft 365) are deleted from AwkTeams, and revocation is requested at the provider
• →They lose access to the Awk console and agentic workers

Ownership transfer

The account owner can transfer ownership to another admin:

1. →Go to Admins → Members in the console
2. →Select the admin you want to transfer ownership to
3. →Type their email address to confirm the transfer

Both parties receive an email confirmation. The previous owner keeps admin access on any teams they already administer; otherwise they become a member.

SSO (Single Sign-On)

SAML 2.0 single sign-on is available on Scale and Enterprise plans, and has been tested with Google Workspace and Microsoft Entra ID (formerly Azure AD). As standards-based SAML 2.0, it is also compatible with other SAML 2.0 identity providers, including Okta.

The owner configures SSO from Settings → SSO Configuration in the console. If you'd like a hand, contact hello@awkteams.ai.

SCIM provisioning

SCIM 2.0 is available on Enterprise plans and has been tested with Okta. It automates user provisioning and deprovisioning — when someone is assigned in your identity provider their AwkTeams account is created automatically, and when they are unassigned or deactivated their access is removed automatically.

For full details on SAML SSO, SSO enforcement, SCIM, and offboarding, see Enterprise SSO & SCIM.

Audit logs

All agentic worker activity is logged. Retention depends on your plan:

Audit logs include agentic worker actions, tool calls, handoffs, and admin changes. View them in the console under Admins → Auditing, where you can filter by date, category, team, or event — and export the trail as CSV or JSON.