Organization

Organizations in Shield360 let you group team members under a shared workspace. Each organization contains one or more projects, and each project owns its own ClickHouse database configuration. Resources such as dashboards, prompts, rules, contexts, and secrets are scoped through the selected organization and project, giving teams isolation without forcing every workspace to become a separate organization.

Key features

• Workspace isolation: Each organization maintains its own database configuration and resource space.
• Project hierarchy: Projects sit inside organizations and group database configurations for different environments, teams, or workloads.
• Role-based access control: Assign Admin or Member roles to control who can manage settings and invite others.
• Email invitations: Invite teammates by email. Invitations can be accepted or declined from the notification panel.
• Multiple organizations: A single user can belong to multiple organizations and switch between them at any time.
• Member management: Admins can view all members, update roles, and remove users from the organization.

Get started

Create an organization

Set up your first workspace in minutes.

1. Navigate to Settings → Organization in Shield360.
2. Click Create Organization.
3. Enter a name for your organization and confirm.

Your new organization is created and set as the active workspace.

Invite team members

Bring your team into the workspace.

1. Go to Settings → Organization → Members.
2. Click Invite Members.
3. Enter one or more email addresses and select a role (Admin or Member).
4. Click Send Invites.

Invited users receive an email with a link to accept and join the organization.

Create a project

Add a project when an organization needs separate database configuration boundaries.

1. Navigate to Settings → Organization → Projects.
2. Enter a project name.
3. Click Create project.

New projects appear in the project dropdown in the top navigation bar.

Switch projects

Projects control which database configuration is active.

1. Use the project dropdown in the top navigation bar.
2. Select the project you want to work in.
3. Open Settings → Organization to manage the project’s database configuration.

Database configuration lists update to match the selected project.

Accept an invitation

When you receive an invitation:

1. Open the link in the invitation email or log in to Shield360.
2. A notification will show the pending invitation.
3. Click Accept to join, or Decline to dismiss.

Once accepted, the organization appears in your workspace switcher.

Manage members and roles

Admins have full control over member management.

1. Navigate to Settings → Organization → Members.
2. View all active members and pending invitations.
3. Change a member’s role between Admin and Member using the role dropdown.
4. Remove a member by clicking the remove icon next to their name.
5. Cancel a pending invitation by clicking Cancel next to the invite.

Switch organizations

If you belong to multiple organizations:

1. Click the organization name in the top navigation bar.
2. Select the organization you want to switch to from the dropdown.

All resources update to reflect the selected organization’s data.

Roles and permissions

Action	Admin	Member
View dashboards, traces, prompts	✅	✅
Create / edit resources	✅	✅
Invite members	✅	❌
Change member roles	✅	❌
Remove members	✅	❌
Delete organization	✅	❌
Manage database configuration	✅	❌
Create and switch projects	✅	✅

Project hierarchy

Shield360 uses the following hierarchy:

Organisation
  Project
    Database configuration

Use organizations for account and membership boundaries. Use projects for separate database configuration boundaries inside the same organization, such as production, staging, customer-specific workspaces, or different teams sharing the same membership model.

Every organization has a default project. Existing organizations are mapped to a default project so database configurations continue to work after upgrading.

Project roles

A member can hold a different role in each project. For example, someone can be an Administrator in one project and a Viewer in another.

To set a project role, open Organization → Projects, choose the project, and pick a role under Project members. Choose Same as organization to remove the project role. Only people who can manage members can do this, and each change is recorded in the audit log.

How project roles combine with organization roles:

• No project role: the member uses their organization role in that project.
• With a project role: while the member works in that project, the project role controls what they can do there. It can grant less than the organization role or more, but only inside that project. It never applies to other projects.
• Organization-wide permissions: permissions for the whole organization always come from the organization role. A project role cannot grant or remove them. These are organization settings, members and roles, billing and the license, the audit log, alerting, and integrations such as SIEM exports. This means a project administrator cannot change members or roles.
• Organization-wide settings under other permissions: a few screens change something for the whole organization even though their permission is otherwise per project. For these, only the organization role counts. They are the organization’s enforcement policy (Protect → Policies), the time zone that budgets follow, and exporting or erasing one person’s data.
• Owners: owners have full access in every project. You cannot give an owner a project role, and Owner is not available as a project role. Use Administrator for full access to a project.
• API keys: an API key belongs to one project through its database. It gets the permissions its creator has in that project.

---

Manage LLM secrets

Centrally store LLM API keys that applications can retrieve remotely without restarts

Manage prompts

Version, deploy, and collaborate on prompts with centralized management and tracking

Multiple databases

Connect and switch between multiple ClickHouse database configurations