Members, rules and settings
Give seats, invite people, manage console administrators, automate account creation and teams, and choose the features your users get.
Seats
A seat gives the right to use the app. An account has only one seat, in one space. In Members and seats → Seats:
- Grant a seat: type the email of an existing account whose address is in a verified domain, and click Grant.
- Any other person receives a seat by invitation: Vato tells you so and offers Create an invitation.
- Remove cuts access to the app immediately. Restore gives it back.
The Origin column shows how each seat was given: console, invitation, SSO, domain, platform.
Invitations
- In Members and seats, enter the person's email and choose what you grant: a seat, and (owners only) a console role.
- Copy the invitation link shown once. Vato does not send emails: send the link yourself.
- The person opens the link, signs in with that exact email address, and accepts.
An invitation is valid for 14 days. Creating a new invitation for the same address replaces the previous one.
Console administrators
The people who manage the space. An administrator does not take a seat.
| Role | Can do |
|---|---|
| Owner | Everything, including roles and payment. |
| Administrator | All the configuration, without roles or payment. |
| Billing | Subscription, usage, invoices and the audit log. |
Only owners change roles. The last owner cannot leave or be demoted.
Automatic rules
In Automatic rules:
| Rule | Effect |
|---|---|
| Create accounts on first sign-in | With SSO, the Vato account is created on the fly, for addresses in a verified domain. |
| Assign a seat automatically | Users signing in through SSO, their domain or your platform get a seat. A seat you removed by hand is never given back automatically. |
| Join by domain | An existing Vato account whose address is proven (Google, Apple) and belongs to a verified domain gets a seat when it signs in. A password sign-up is never proven, so it never joins automatically. |
| Require SSO | See Single sign-on. |
| Default team | New members join this team, with the chosen role. |
| Identity provider groups | A group received from your provider places its members in a team with a role, or gives them console access. A role is never downgraded by a rule, and the owner role cannot be assigned. |
| Remove the seat after a period of inactivity | Between 30 and 365 days. A seat removed for inactivity comes back at the next sign-in. |
| Active seat limit | Beyond it, no more seats are assigned. |
Teams
In Teams, create a team (you become its owner) or attach an existing team you own. Rules can only target teams attached to the space. Detach removes a team from the space without deleting it.
App settings
In App settings, choose what your users get. Open apps apply changes immediately, without a restart: usually in well under a second. An app that was offline catches up as soon as it reconnects. A seat you remove or give back takes effect the same way: removing it closes access within a second, and giving it back reopens the app within about 3 seconds.
| Setting | Effect |
|---|---|
| Workspaces | Personal and team (default), Teams only or Personal only. With Teams only, the app has no personal workspace: a member who is not in any team yet waits on the workspace screen until an administrator adds them to one. Personal only turns teams off. |
| Allow personal teams | Shown unless Personal only is chosen. Whether members can create their own teams outside the company. |
| Where agents run | Computers and cloud (default), Members' computers only or Cloud only. Members' computers only turns off Vato Cloud and team runners. With Cloud only, agents never run on a member's computer: a new personal conversation starts in the member's Vato Cloud environment, and a team conversation runs on a team runner. |
| Model access | Both (default), Each member's own accounts or Organization models. Each member's own accounts: members connect their own subscriptions or API keys, and the team provider gateway and Vato AI are turned off. Organization models: agents use the models published by your teams' provider gateway, plus Vato AI, and members cannot connect personal accounts or API keys. It requires Teams only, which the console selects for you. |
| App features | Turn off Bots, Vato Design, Vato Cloud, Computer Use, integrations, the mobile app, voice or skills. The feature disappears from the app. Teams follow Workspaces, and Vato Cloud is off with Members' computers only. |
| Agent providers | All providers, or only a selection. Other providers are hidden and cannot be used. |
| Sign in with a claude.ai account | Off by default for a reseller: Anthropic only allows claude.ai account sign-in in a resold product with its written approval. |
| Allowed models | One provider/model per line. Empty: all models. |
The console refuses a combination that would leave nowhere to work, and tells you which setting to change:
- Organization models with a personal workspace: these models are served to team workspaces.
- Cloud only with Vato Cloud turned off, when members have a personal workspace: the personal workspace can only run in Vato Cloud.
- Cloud only with Vato Cloud turned off and Each member's own accounts: team runners run organization models, so teams would have nowhere to run.
These settings are configuration guardrails: users remain in control of their own computer. What Vato serves (seats, teams, Cloud, Design projects, integrations, mobile app connection, team gateway runs and runners, Vato AI) is enforced on Vato's servers.
Your users see the settings in Settings → Organization in the app.
Audit log
Audit log lists who changed what and when: configuration, seats, invitations, SSO sign-ins and tests, API keys, payments.