Organizations
Foundry's Organization feature supports team-based collaboration and resource management. With a structured role-based access control (RBAC) system, you can achieve both security and operational efficiency.
Organization Role System
Foundry provides fine-grained permission management through a three-tier role hierarchy.
| Role | Permission Level | Description |
|---|---|---|
| Owner | Highest | Holds all permissions within the organization |
| Admin | Intermediate | Can manage settings and members |
| Member | Basic | Can view and contribute |
Owner
The role with the highest authority in the organization.
Scope of permissions:
- Delete the organization
- Change the organization slug (URL path)
- Modify all settings
- Manage all members (add, remove, change roles)
- Invite members to any role (Owner, Admin, Member)
Constraints: The last remaining Owner cannot leave the organization and cannot be removed.
Admin
The role responsible for day-to-day organization operations.
Scope of permissions:
- Modify organization settings (excluding deletion and slug changes)
- Can only invite members with the Member role
- Can change and remove members with the Member role
Constraints: Cannot invite to Owner/Admin roles, cannot delete the organization
Member
The default role for general team members.
Scope of permissions:
- View repositories within the organization
- Contribute to repositories (depending on permissions)
Members cannot invite new members or change other members' roles.
Member Management
Invitation Process
Member invitations are processed via email.
- A person with Admin privileges or higher submits an invitation request (specifying email and role)
- The system sends an invitation email
- Existing users accept directly; new users register and then accept
Invitation Rules
| Inviter Role | Invitable Roles |
|---|---|
| Owner | Owner, Admin, Member |
| Admin | Member |
| Member | Cannot invite |
Invitations expire automatically after 30 days; re-inviting is possible after expiration.
Role Change Rules
- Owner: Can change the role of any member (except changing the last Owner's role)
- Admin: Can only change members with the Member role; cannot promote to Owner/Admin
Member Removal Rules
| Scenario | Allowed |
|---|---|
| Owner removes a Member | Yes |
| Owner removes an Admin | Yes |
| Owner removes another Owner | Yes (not allowed if last Owner) |
| Admin removes a Member | Yes |
| Admin removes an Admin/Owner | No |
Repository Permission Integration
Organization roles are automatically linked to access permissions for repositories belonging to that organization.
| Organization Role | Repository Permission | Permission Description |
|---|---|---|
| Owner | owner | Full access including deletion and settings changes |
| Admin | write | Upload, commit, merge PRs |
| Member | read | View, create Pull Requests |
Differences from Personal Repositories
| Item | Organization Repository | Personal Repository |
|---|---|---|
| Owner permission | Automatically granted to org Owner | Only the individual is Owner |
| Collaboration | Automatically granted to org members | Requires individual invitation |
Permission Matrix
Organization Management Permissions
| Feature | Owner | Admin | Member |
|---|---|---|---|
| View organization profile | Yes | Yes | Yes |
| View organization settings | Yes | Yes | No |
| Modify organization settings | Yes | Yes | No |
| Change organization slug | Yes | No | No |
| Delete organization | Yes | No | No |
Member Management Permissions
| Feature | Owner | Admin | Member |
|---|---|---|---|
| View member list | Yes | Yes | Yes |
| Invite members | Yes | Yes (Member only) | No |
| Remove members | Yes | Yes (Member only) | No |
| Change roles | Yes | Yes (Member only) | No |
| Assign Owner/Admin roles | Yes | No | No |
Repository Management Permissions
| Feature | Owner | Admin | Member |
|---|---|---|---|
| Create repository | Yes | Yes | No |
| View repository | Yes | Yes | Yes |
| Delete repository | Yes | No | No |
| Upload/commit files | Yes | Yes | No |
| Create Pull Request | Yes | Yes | Yes |
| Merge Pull Request | Yes | Yes | No |
Public / Private Organizations
| Setting | Non-logged-in users | Non-member logged-in users | Members |
|---|---|---|---|
| Public | Can view profile | Can view profile | Full access |
| Private | No access | No access | Full access |
Private organizations are not exposed to non-members at all (404 response), and are designed to prevent information enumeration attacks.
Notification Events
| Event | In-app Notification | Email Notification |
|---|---|---|
| Organization invitation sent | Yes | Sent immediately |
| Member role changed | Yes | Sent immediately |
| Member removed | Yes | Sent immediately |
| Organization deleted | Yes | Sent immediately |
Creating and Deleting Organizations
Creation Rules
| Item | Rule |
|---|---|
| slug format | 3–30 characters, alphanumeric and dashes, cannot be digits only |
| Reserved words | Cannot use any of the 88 system-reserved words |
| Initial role | Creator is automatically assigned the Owner role |
Deletion Handling
When an organization is deleted, all memberships, pending invitations, and organization repositories are also deleted, and a deletion notification is sent to all members.
Use Cases
Corporate Department Operations
Organization: AI Research Team
├── Owner: Team Lead
├── Admin: Senior Researcher
└── Member: Junior Researcher, Intern
- Team Lead: Full management access to all repositories
- Senior: Upload models and manage datasets
- Junior/Intern: View and contribute via Pull Requests
Project-Based Operations
Organization: ProjectX
├── Owner: Project Manager
├── Admin: Tech Lead
└── Member: Developer, Data Scientist
Glossary
| Term | Description |
|---|---|
| Organization | A collaborative workspace for a team |
| Role | A user's permission level within the organization |
| slug | The URL path that identifies an organization (e.g., /orgs/my-team) |
| RBAC | Role-Based Access Control — a method of restricting access based on roles |
| Pull Request | A collaborative feature for proposing and reviewing changes |