# Onboard a team

Invite members, give them roles, decide who sees each project, set up notifications and let people connect their own agents.

*Where in the portal: Members, Projects, Settings*

*Last updated: 2026-10-21*

Bring a team in the order they need things: people, access to projects, the emails they get, then agents that work on their findings. An owner or administrator does the first steps; each person does the last two for themselves.

## Invite members

1. **Check the plan**

   A plan sets how many members can join, and pending invites count toward the limit. See [Plans and the trial](https://kelrova.com/docs/organization/plans) before inviting a larger team.

2. **Use a team workspace**

   A personal workspace has no one to invite. On **Members**, choose **Create team workspace** or **Convert this workspace to a team** first. See [Members and roles](https://kelrova.com/docs/organization/members).

3. **Send invitations**

   Owners and admins of the team open **Members** and choose **Invite member**. An invitation expires in 7 days. Every invite joins as a Member, and you change the role after the person joins. The roles are Owner, Admin and Member; see [Members and roles](https://kelrova.com/docs/organization/members).

![The Invite member dialog with an email address entered, a note that the person joins as a Member, and Send invite.](https://kelrova.com/docs/img/organization/members.png)

*The Invite member dialog over the Members list.*

## Decide who sees each project

A project is visible to the whole organization, or Restricted so only the members you add can see its scans and findings. Each added member gets Viewer, Contributor or Maintainer. Set this before the first scan if the findings are sensitive. On **Projects**, open the project's **…** menu and choose **Manage access**. See [Project visibility and project roles](https://kelrova.com/docs/organization/project-access).

![The access settings of a restricted project: three members, each with a role and the extra permissions they hold.](https://kelrova.com/docs/img/organization/project-access.png)

*Manage access on a restricted project, with members, project roles and sensitive permissions.*

## Set up notifications

Each person chooses their own emails in **Settings → Notifications**. Optional emails include **Scan results**, a summary when a scan they started finishes, and **Scheduled scans**, a note when a scheduled scan could not start. Owners also see **Plan and usage**, and owners and admins see **Code host connections**. Every optional email ends with an unsubscribe link; opening it changes nothing until the person presses **Unsubscribe**.

![The optional emails Kelrova sends, such as scan results and scheduled scan notices, each with its own on and off switch.](https://kelrova.com/docs/img/schedules/email-preferences.png)

*Settings → Notifications with the switches for the emails you can turn off.*

To have scans run on their own, add a schedule: [Scheduled scans](https://kelrova.com/docs/schedules/schedules). The emails are listed on [Email notifications](https://kelrova.com/docs/schedules/email), and [Preferences and unsubscribe](https://kelrova.com/docs/schedules/unsubscribe) covers opting out.

## Connect agents

MCP is included on every plan. Each member connects their own agent: the first connection opens the browser, where they sign in, pick the organization and projects and choose what the agent may do. A connection never sees more than its member can, and each one is listed and revoked under **Settings → Connected apps**.

![A member's Connected apps settings: the apps they approved, what each can do, and Revoke.](https://kelrova.com/docs/img/mcp/connected-apps.png)

*Settings, Connected apps: each application with its connections and a Revoke button.*

Send members to [Connect a client](https://kelrova.com/docs/mcp/connect) and [Access levels and staying connected](https://kelrova.com/docs/mcp/access). Owners and admins manage the rest under **Organization → MCP server**: the switch for the whole organization, whether agents may report or request re-checks, which apps may connect and how long connections last. See [Organization settings for MCP](https://kelrova.com/docs/mcp/organization). A member who leaves the organization ends their connections without anyone doing anything.

> **Note**
>
> Re-checks requested by agents count against the organization's scan usage. [What a scan uses](https://kelrova.com/docs/scans/usage) shows where it goes.

## Next

Run the team's first scan together: [Run your first scan](https://kelrova.com/docs/getting-started/first-scan). Billing is for owners and members an owner has given billing access ([Billing, balance and invoices](https://kelrova.com/docs/organization/billing)). Admins and members with the audit grant can read the [Audit log](https://kelrova.com/docs/organization/audit).

## Related

- [Members and roles](https://kelrova.com/docs/organization/members)
- [Project visibility and project roles](https://kelrova.com/docs/organization/project-access)
- [Email notifications](https://kelrova.com/docs/schedules/email)
- [Access levels and staying connected](https://kelrova.com/docs/mcp/access)