Team management
Invite users, organize departments, manage on-call and out-of-office, and deactivate cleanly.
Inviting users
Open Settings → Team → Invite. Fill in:
- Email — must be on a verified domain. ThorStack rejects invites to free-mail addresses unless the Owner explicitly allowed them.
- Role — the built-in role; a Member by default. See RBAC.
- Department(s) — Finance, Sales, etc. Drives module access.
- Manager — optional; used for approval gate routing.
The invitee gets a magic-link email. They set a password and turn on MFA on first login. MFA is mandatory for Admin and above; recommended for everyone.
Departments
Departments mirror real org structure. The defaults are: Executive, Sales, Marketing, Finance, Operations, Engineering, Product, HR, Legal, Data & Security, R&D. You can rename or add your own. Department membership grants the standard permissions for that area; removal revokes them.
On-call and OOO
Two state flags affect routing:
| Flag | What it does |
|---|---|
| On-call | This user is the current go-to for their department. Approval gates route here first. |
| Out of office | This user is paused. Their queues hand to their manager or the configured backup. |
Both can be scheduled in advance (next Monday's PTO is set today). When OOO ends, queues are not silently dumped on the user — items wait or escalate per the configured policy.
Deactivation
Deactivation is the right way to off-board:
- The user is immediately denied access to Mission Control.
- Their OAuth grants are revoked at every connected provider.
- Their owned records are reassigned to a successor you pick. Nothing dangles.
- Their audit history is preserved — deactivation never deletes the trail.
You can reactivate within 90 days; after that the row is hard-archived per your retention policy.
SCIM (Operator+)
On Operator and Sovereign plans, you can wire up SCIM so user lifecycle is driven by your IdP (Okta, Entra, Google Workspace). Departments map from group claims. SCIM treats deactivation the same as the manual flow above.
Next
- RBAC — the underlying permission model.
- Approval gates — how on-call drives gate routing.