Organization, members and roles
Members and invitations, the four roles and exactly what each can do, seats per plan, MFA, and the audit log.
PulseTrace is multi-tenant: everything belongs to an organization, members join by invitation, and a role decides what each member can do. Service accounts hold roles too, which bounds the keys they own.
Roles
| Role | Can |
|---|---|
| Viewer | Read everything: monitors, results, incidents, anomalies, intelligence, agents, notification rules, webhooks, maintenance windows and the organization. |
| Developer | Viewer, plus create and update monitors, enable and disable them, create and update notification rules, webhooks and maintenance windows. Can read environments, credentials and service-account listings. |
| Admin | Developer, plus delete monitors, notification rules, webhooks and maintenance windows; manage agents; manage members, API keys, service accounts, environments, credentials, destinations, status pages and the API/MCP policies. |
| Owner | The same permission set as Admin, plus ownership of the organization and its plan and billing. |
The permission matrix is on Settings → Roles in the app. Server-side, organization management and every write to keys, service accounts, credentials and environments requires owner or admin; read-side listings are open to developers.
Members and seats
- Invite by email from Settings → Organization; the invitation carries the role. Seats per plan: Free 1, Team 5, Pro 20, Enterprise unlimited.
- A member's role can be changed or the member removed by an owner or admin. Prefer service-account keys for anything production depends on, so a departure never takes automation with it.
- Email verification is required before a member receives alert emails.
Authentication
Members sign in with email and password; passwords are bcrypt-hashed and sign-in is protected by progressive lockout and CAPTCHA on abuse. TOTP two-factor authentication is available to every member under Settings → MFA (with recovery codes), an owner or admin can make it required for the whole organization under Organization → Security, and it is mandatory for platform administrators. The MCP policy can additionally require MFA before a member authorises an AI client.
Audit log
Every administrative action — membership, roles, keys, service accounts, destinations, policies, plan changes — is written to a searchable, sortable audit log with who, what, when and from where. API requests made with keys are logged separately and shown per key under Developer API. Both are retained per the plan's audit retention; see Retention.