Inviting users and roles
Add teammates to your organisation, pick the right role, and manage who has access to what.
Updated 27 Jul 2026
Clment is built around teams. This page covers the invite flow, role choices, role changes, and removing access.
The two roles
Every member of an organisation has exactly one role — Member or Admin. What each can do:
| What you can do | Member | Admin |
|---|---|---|
| Upload contracts, run reviews, generate updated (marked-up) contracts | ✔ | ✔ |
| Edit contract details, tags, and key dates | ✔ | ✔ |
| Comment, mention teammates, ask the AI Assistant questions | ✔ | ✔ |
| Create and edit rulebooks | ✔ | ✔ |
| Add review feedback to a rulebook an admin has locked | — | ✔ |
| Lock or unlock a rulebook (the Admin-only switch) | — | ✔ |
| Invite and remove team members, change roles | — | ✔ |
| Billing, plans, and credit packs | — | ✔ |
| Security settings, API keys, webhooks, audit log | — | ✔ |
Roles are per-organisation. The same person can be Admin in one org and Member in another.
Rulebooks and roles
Every member can create and edit rulebooks by default — review feedback flowing back into your rulebooks is how they improve. An admin can lock an individual rulebook (the Admin-only switch in the rulebook editor), which makes it read-only for members: they keep using it in reviews, and their review feedback still accumulates, but only admins can edit, delete, or apply Refine from review data to a locked rulebook.
Every org needs at least one Admin. The last Admin can’t be demoted or removed without first promoting another user.
Inviting one person
- Settings → Team → + Invite team member.
- Enter email + pick a role.
- Click Send invitation.
The invitee gets an email with a magic-link button. Clicking it:
- Opens Clment with the invitation accepted automatically.
- If they don’t have a Clment account, walks them through sign-up.
- If they already have one, drops them straight into your org.
Invitations stay valid for 30 days. Re-send from the Team page if they expire.
Bulk inviting from a CSV
For onboarding a whole team at once, use Settings → Team → Bulk invite.
The CSV format is one row per person, email,role:
[email protected],admin
[email protected],member
[email protected]
[email protected],admin
Notes:
- Role is optional. If omitted (like Carol above), the row uses the default role you’ve picked in the dialog.
- A header row is optional. If the first row contains the literal word
emailand no@, it’s treated as a header and skipped. - Up to 200 rows per upload. For larger lists, split into multiple batches.
- Live preview. As you paste, the dialog tells you how many valid rows it sees and flags any with issues (missing email, unknown role) before you submit.
- Partial results are fine. If 195 rows succeed and 5 fail (already a member, malformed email, etc.), the 195 invitations go out and the 5 problem rows are shown in a summary — you can fix them and re-upload just those.
- Seat cap. If the batch would put you over your plan’s seat limit, the whole batch is rejected with a clear message; shrink the CSV or upgrade the plan and retry.
A success summary lists every email that was invited; a “skipped rows” table lists anything that didn’t go through and why.
Changing roles
Settings → Team → ⋯ menu next to a user → Change role.
Role changes:
- Take effect immediately.
- Are logged in the audit trail (who changed whose role, when).
- Don’t invalidate the user’s current session — they keep working but with the new permission set.
Removing users
Settings → Team → ⋯ menu → Remove from organisation. Removed users:
- Lose access immediately. Their session is terminated within about a minute.
- Stay in the audit log (history isn’t deleted — their record is retained, marked as revoked).
- Historic attributions don’t change. A review signed off by them still shows their name on the record.
- Have their machine credentials revoked automatically. Any MCP connector tokens they issued, and any API keys they created, in this organisation are revoked at the same time — so a departing user can’t keep calling the API or an AI connector with a token they minted. (Credentials for other organisations they belong to are unaffected.)
- Have any outbound webhooks they set up paused. Clment stops sending your organisation’s event data to a destination the departing user configured, until a remaining admin reviews and resumes it. Pausing keeps the webhook’s configuration intact for that review — it isn’t deleted.
Heads-up for integrations: if a live integration — a Slack app, a CRM sync, a custom script — authenticates with an API key that the removed user originally created, it will stop working when they’re removed. Re-issue that key under a remaining admin (Settings → API keys) before removing them, or right after.
A webhook they set up is paused, not deleted. Pausing stops Clment delivering, but it doesn’t change the signing secret the departing user already knew. To resume it safely, a remaining admin should rotate the signing secret (Settings → API Keys, then Rotate secret on the webhook), update the receiving endpoint with the new secret, then un-pause — or just delete and recreate the webhook.
Contracts aren’t owned by individuals, so there’s nothing to reassign — a removed user’s contracts and reviews stay with the organisation.
“I can’t remove the last Admin”
By design. Promote someone else to Admin first, then remove yourself if needed.
If you’re a sole Admin and need to hand over the org (e.g. you’re leaving the company), the workflow is:
- Invite your replacement.
- Promote them to Admin once they’ve accepted.
- Hand over any machine credentials before you leave, because removing yourself revokes or pauses the ones you created: have the new admin re-add MCP connectors and re-issue any in-use API keys under their own account (Settings → API keys), and take over any webhooks (rotate the secret and re-point the receiving endpoint, then resume).
- Have the new admin remove you from Settings → Team. (There’s no self-service “leave organisation” — removal is an admin action, which is why step 2 comes first.)
Free tier vs Pro
The Free plan supports one user per organisation. Inviting a second member prompts an upgrade to Pro on the Team page.
Paid plans include a user limit — Pro up to 5, Business up to 20, Enterprise unlimited — but no per-seat charge: billing is on credit consumption, not headcount.
Cross-org membership
The same email can be invited to many orgs. From the user’s side, switching between orgs uses the org picker in the top bar — no separate logins.
See also
- Inviting your team — the simpler getting-started version of this guide.
- Mentions and assignments
- Security and SSO