Organizations

Overview

Organizations are the top-level tenant in Agent Action Firewall. Each organization has isolated data, policies, and settings.

• Data Isolation — Complete separation of actions, policies, and audit trails
• Team Management — Invite members and assign roles
• Billing — Per-organization subscription and usage tracking
• Custom Settings — Configure policies, integrations, and preferences

Creating an Organization

Via Dashboard

1. Click your profile icon → Create Organization
2. Enter organization details:
   • Name: Display name for the organization
   • Slug: URL-safe identifier (e.g., acme-corp)
3. Select your billing plan
4. Click Create

Via API

curl -X POST https://api.agentactionfirewall.com/v1/organizations \
  -H "Authorization: Bearer $USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Acme Corporation",
    "slug": "acme-corp"
  }'

Organization Settings

General Settings

Security Settings

Policy Defaults

Configure default behavior for new policies:

{
  "default_decision": "allow",
  "default_approval_timeout_minutes": 60,
  "require_policy_description": true,
  "enable_policy_versioning": true
}

Member Management

Inviting Members

1. Go to Settings → Team
2. Click Invite Member
3. Enter email address
4. Select role
5. Click Send Invite

Roles

Role Permissions Matrix

Data Isolation

Row-Level Security

All data is isolated using PostgreSQL Row-Level Security (RLS):

• Actions scoped to org_id
• Policies scoped to org_id
• Audit events scoped to org_id
• API keys scoped to org_id

Cross-Organization Access

Cross-organization access is not supported. Users must switch between organizations to access different tenants.

Data Residency

Self-hosted deployments can enforce data residency:

# Organization-specific database
organizations:
  acme-corp:
    database_url: postgres://eu-west.db.example.com/acme
  globex:
    database_url: postgres://us-east.db.example.com/globex

API Keys

Organization-Level Keys

Create API keys for the organization:

1. Go to Settings → API Keys
2. Click Create API Key
3. Set permissions and expiry
4. Copy the key (shown only once)

Key Permissions

Key Rotation

Rotate keys without downtime:

1. Create new key with same permissions
2. Update applications to use new key
3. Delete old key after verification

Usage & Limits

Viewing Usage

Monitor usage in Settings → Usage:

Plan Limits

Upgrading

Upgrade from Settings → Billing → Change Plan.

Audit Trail

Organization Events

All administrative actions are logged:

Exporting Audit Logs

Export organization events:

curl -X GET "https://api.agentactionfirewall.com/v1/audit?category=organization" \
  -H "Authorization: Bearer $TOKEN"

Deleting an Organization

Requirements

• Must be the organization Owner
• No active subscription (downgrade to Free first)
• Confirm by typing organization name

Process

1. Go to Settings → Danger Zone
2. Click Delete Organization
3. Type organization name to confirm
4. Click Permanently Delete

Data is retained for 30 days before permanent deletion. Contact support to restore within this period.

Troubleshooting

Cannot invite members

1. Verify you have Admin or Owner role
2. Check member limit hasn't been reached
3. Ensure email address is valid
4. Check if user already has pending invite

Member cannot access organization

1. Verify invite was accepted
2. Check member role has required permissions
3. Ensure IP allowlist includes their IP
4. Verify 2FA is completed if required

API key not working

1. Verify key hasn't expired
2. Check key has required permissions
3. Ensure org_id in request matches key
4. Verify key wasn't deleted