User Management
Audience: Admin Page Type: How-To Guide Duration: 15 minutes
Overview
User Management lets Admins invite team members, assign roles, manage organizational unit memberships, suspend memberships, and remove users permanently. All user management is done from Settings → Users. Company Admins, Strategy Managers, Group Admins, and Super Admins can use this screen; each works only up to their own level (see Who can manage whom?).
Viewing the User List
- Go to Admin → Users from the left menu
- All users in your tenant are listed with:
- Name and email address
- Assigned role
- Organizational unit
- Membership status (Active / Suspended)
Filtering
| Filter | Description |
|---|---|
| Name / Email | Search by partial name or email |
| Role | Filter by role (Admin, CEO, Strategy Manager, etc.) |
| Membership status | Active (default) / Suspended / All |
| Unit | Filter by organizational unit |
Inviting a New User
- Click + Add User
- Fill in:
| Field | Required | Notes |
|---|---|---|
| Yes | Must be a valid email address | |
| First Name | Yes | |
| Last Name | Yes | |
| Role | Yes | See Roles & Permissions for full role list |
| Organizational Unit | Yes | Which unit this user belongs to |
- Click Send Invite
The user receives an invitation email with a one-time link to set their password. Until they accept, their status shows as Invited.
The role list shows only the roles you can assign. A Strategy Manager can invite up to Strategy Manager, an Admin up to Admin, a Group Admin up to Group Admin. You cannot revoke or delete an invitation above your own level (for example, an Admin cannot revoke a Group Admin invitation).
Adding a person who already has an account
If the email already belongs to a COS account, the person is added to your company with a new membership:
- Their name, password, and memberships in other companies do not change. The name in the form is ignored.
- If the person is already an active member of this company, the add is refused and their role does not change. Change the role from the list.
- If the person has a suspended membership in this company, the add is refused; the screen offers a Reactivate shortcut.
- Super Admin accounts cannot be added as company members.
If a user hasn't received or has lost the invitation email, open their profile and click Resend Invite.
Changing a User's Role
A user's role determines what they can see and do in COS. To change a role:
- Find the user in the list
- Click their name to open their profile
- Click Edit
- Open the Role dropdown and select the new role
- Click Save
The change takes effect on the user's next page load or login.
You cannot change your own role. The company's last active Admin cannot be moved to another role; make another user Admin first.
Changing a role from a higher-permission role (e.g., CEO) to a lower-permission role (e.g., Member) will immediately restrict access. The user will lose access to approval queues, admin panels, and other elevated features.
Role reference
| Role | Description |
|---|---|
| ADMIN | Full system access — manage users, configure settings |
| CEO / COMPANY_LEADER | Full strategic view, final approvals on OKRs and resources |
| STRATEGY_MANAGER | Manage analyses, OKR cycles, focus areas, BSC |
| DEPARTMENT_MANAGER | Manage their unit's OKRs and team members |
| TEAM_LEAD | Manage their team's OKRs and check-ins |
| MEMBER | View and check-in on assigned OKRs |
For a full breakdown of what each role can do, see Roles & Permissions.
Who can manage whom?
Each user assigns roles only up to their own level, and changes the role of, suspends, removes, or sends a password reset link only to users up to their own level. Level order: Member < Team Lead < Strategy Manager < Admin < Group Admin < Super Admin.
| You | Roles you can assign | Users you can manage |
|---|---|---|
| Super Admin | Admin, Strategy Manager, Team Lead, Member | Everyone (Super Admin accounts only from platform administration) |
| Group Admin (of the company's group) | Admin, Strategy Manager, Team Lead, Member | Member, Team Lead, Strategy Manager, Admin, other Group Admins; not the group owner or Super Admins |
| Admin | Admin, Strategy Manager, Team Lead, Member | Member, Team Lead, Strategy Manager, Admin |
| Strategy Manager | Strategy Manager, Team Lead, Member | Member, Team Lead, Strategy Manager |
| Team Lead, Member | — | — |
Protected users:
- Your own account: you cannot change your role, suspend, or remove yourself.
- The Group Admin of the company's group and Super Admins: Admins and Strategy Managers cannot act on them.
- The group owner: only a Super Admin changes their company membership.
- The company's last active Admin: cannot be demoted, suspended, or removed.
- A user who belongs to several companies: only a Super Admin, or a Group Admin whose group holds all of the user's companies, can reset their password.
Actions on protected rows are locked; hover to see the reason.
User name
Only the user changes their own name, from their profile. Admins, Group Admins, and Super Admins cannot change another user's name; the user list has no name field.
Changing a User's Organizational Unit
If a user moves to a different department or team:
- Open the user's profile
- Click Edit
- Change the Organizational Unit field
- Click Save
This reassigns all future analytics and OKR visibility to the new unit. Historical data from the previous unit is preserved.
Suspending a Membership
To close a user's access to the company temporarily:
- Find the user in the list
- Choose Suspend on their row
- Confirm
What happens after suspension:
- The user cannot enter this company; open sessions end on the next request
- Their role, unit leaderships, assignments, and OKR/KPI ownerships are kept
- Their memberships in other companies do not change
- They are hidden from the default list; select Suspended in the Membership status filter to see them
Reactivating a Membership
- Select Suspended in the Membership status filter
- Choose Reactivate on the user's row
- Confirm
The user gets back into the company with the same role and ownerships. If your plan's user limit is full, reactivation is refused.
Removing a User Permanently
Permanent removal cannot be undone: the membership is deleted and unit leaderships, assignments, and OKR/KPI ownerships are cleared. To close access temporarily, use Suspend instead.
- Choose Remove permanently on the user's row
- Type the user's email in the confirmation dialog
- Click Remove permanently
Suspend, reactivate, and permanent removal follow the Who can manage whom? rules.
Suspended Company
When your company is suspended, it becomes read-only:
- You can log in, switch companies, and view all data. You can change your own profile and password.
- Company users, Admins included, cannot make changes. AI chat, notifications, and personal dashboards are read-only too.
- Super Admins and the Group Admin of the company's group can still make changes to fix things.
- A "Company suspended, view only" banner is shown at the top of the screen.
Only a Super Admin and the Group Admin of the company's group change the company status (active / suspended). Admins see the status on the company profile but cannot change it. From 0.5.44 Strategy Managers cannot open the company profile screen (Roles & Permissions).
Suspending an Account (Super Admin)
A Super Admin can suspend an account platform-wide (Admin → Users, Suspend account):
- The person cannot log in with a password or Google; invitation and password links do not work. Open sessions end.
- API keys created by the account are rejected (not deleted). Integrations owned by the account are skipped by the scheduler.
- Company memberships, roles, and group memberships do not change. Reactivate account restores login.
- A Super Admin cannot suspend their own account or the platform's last active Super Admin.
Invite several users
Add users through the invitation flow under Settings → Users. Every invitation follows role ceilings, last-administrator protection and the group's effective user limit. This screen does not provide CSV upload or preview steps.
Invitation email delivery depends on SMTP configuration. If email cannot be sent, use the invitation-link flow shown on screen; share the link only with the intended person.