Organization Overview

The Team page manages membership and access control. Info cards show Total Members, Administrators, and Pending Invites. Multi-org users see an Organization Switcher dropdown.

Members Table

Email, Role (Administrator/Member), Join Date, and Remove button (admin only).

Roles & Permissions

Capability	Administrator	Member
View agents, health, sessions, alerts	✓	✓
Configure agents	✓	✓
Run live sessions and queries	✓	✓
Invite/remove members	✓	✗
Create/revoke registration tokens	✓	✗
Purchase subscriptions for members	✓	✗
Manage org settings & billing	✓	✗
Delete organization (creator only)	✓*	✗

* Only the user who originally created the organization can delete it, even if other users have the Administrator role.

Inviting Members

1. Click Invite Member (admin only)
2. Enter email and select role (Administrator or Member)
3. Click Send Invite
4. Invitation appears in Pending Invitations table with Revoke option

Shared Resources: All org members share the same query pool, agents, alert rules, notification channels, and agent seats.

Workspace cascade: When a new member accepts an invitation that lands them in your workspace, they are automatically added to every Clerk organization in the workspace, not just the one they were invited into. Likewise, if you create a new organization later, all existing workspace members are added to it. This means “workspace member” and “has access to all orgs in the workspace” are equivalent. To grant org-only access (e.g. a client contact who should see only their own organization), invite them at the organization's URL rather than at your workspace URL.

Team Subscriptions

Organization admins can purchase query subscriptions on behalf of team members. This ensures every member has access to AI diagnostics without requiring each person to manage their own billing.

How It Works

1. From the Dashboard, click Manage Team Subscriptions in Quick Actions
2. A modal displays all organization members with their current subscription status
3. For any unsubscribed member, click Buy Plan
4. Select a tier (Professional, Business, or Enterprise) and click Proceed to Checkout
5. Complete payment in Stripe — the subscription is created immediately for the target member

Subscription Ownership

• Admin-purchased: The admin who bought the subscription can cancel it. The subscription's billing is tied to the organization's Stripe customer. Shown with an “Admin-purchased” badge.
• Self-purchased: Members who buy their own subscription manage it through their personal Stripe billing portal. Shown with a “Self” badge. Admins cannot cancel self-purchased subscriptions.

Cancelling Admin-Purchased Subscriptions

Click the Cancel button next to any admin-purchased subscription. Cancellation takes effect immediately with prorated billing.

How Subscriptions Pool

Each subscribed member contributes their tier's query quota and 20 free agent seats to the organization pool. For example, if an admin purchases Professional for 3 members, the org gets 3,000 queries/month and 60 free agent seats.

Creating Organizations

Organizations are the fundamental scoping boundary in ET Ducky. Every resource — agents, registration tokens, alert rules, notification channels, queries, tags, and team members — belongs to exactly one organization.

When to Create Separate Organizations

• MSP / Multi-Client: Create one organization per client to keep agents, billing, and data fully isolated
• Environment Separation: Separate Production, Staging, and Development environments into distinct orgs for access control
• Business Units: Large enterprises can use orgs to give each team independent query pools and agent budgets

How to Create

1. Click + New Organization on the Dashboard, Team page, or Agent Setup page
2. Enter an organization name
3. Click Create Organization — the new org is created via Clerk and set as your active org immediately
4. Invite team members and set up subscriptions as needed

Multi-Org Users: Use the organization dropdown on the Dashboard, Agents, and Team pages to switch between organizations. All metrics, agents, and settings update to reflect the selected org.

Subdomain ↔ Org Name

If your workspace uses a custom subdomain (e.g. acme.etducky.com), renaming the subdomain on the Workspaces & Custom Domains page cascades automatically to the underlying Clerk organization name. This keeps the org name in the switcher dropdown in sync with your subdomain — no more “why is my org called swift-otter-823 when my subdomain is acme?” mismatch. Members don’t need to refresh; the Clerk webhook propagates the rename within a few seconds.

Deleting Organizations

Only the original creator of an organization can delete it. Organization deletion is permanent and irreversible.

What Gets Deleted

• All agents registered to the organization
• All registration tokens
• All alert rules and notification channels
• All query history and usage data
• All team memberships and pending invitations
• All associated billing subscriptions

How to Delete

1. Navigate to the Team page
2. Select the organization you want to delete from the dropdown (if you have multiple)
3. Click the red Delete Organization button in the Organization info card (visible to admins only)
4. Type the organization name exactly as shown to confirm
5. Click Delete Organization to proceed

Creator-Only: If you are an admin but not the creator of the organization, the deletion will be rejected by the server. Only the user who originally created the organization can delete it.

Registration Tokens

Registration tokens are the secure method for authenticating agent installations. Only organization admins can create and manage tokens.

Creating Tokens

1. Navigate to the Agent Setup page
2. Click + New Token
3. Give it a descriptive name (e.g., “Production Servers”, “IT Team Deploy”)
4. Optionally set a max agent limit and expiry date
5. Check Allow Public Download Link to generate a shareable URL for the installer — no sign-in required for end users
6. Check Sign for Production Use to EV code-sign the installer with the ET Ducky LLC certificate. Signed installers display the verified publisher in the Windows UAC prompt and avoid SmartScreen warnings. Each organization is limited to 4 signed production tokens at a time — revoke an existing production token to create a new one.
7. Click Download to get a ready-to-run installer with the token embedded

One-click deployment: The Download button generates a self-contained installer pre-configured with your token. Run it on any Windows machine — no manual token entry or command-line arguments needed. You can re-download at any time for any active token.

Token Security

• Tokens are stored as SHA-256 hashes — the plaintext is never persisted
• An encrypted copy of the token is stored server-side to enable on-demand installer downloads
• Each token is scoped to a single organization
• Tokens can be revoked at any time to prevent further registrations and disable installer downloads
• Public download links return 404 for revoked, expired, or limit-reached tokens — no information is leaked about token existence
• Production (signed) installers are built and signed once at token creation, then cached on the server for instant downloads
• Use separate tokens per environment (production, staging, dev) for audit control
• Usage counters track how many agents each token has registered

Managing Tokens

The Agent Setup page lists all tokens for your organization with their prefix, name, usage count, status, and expiry. Use the Download button to get a pre-configured installer, Copy Link to copy the public download URL (if enabled), Revoke to disable a token, or Delete to remove it permanently.