# Members Management Overview

> Manage organization members, roles, permissions, and invitations in the TanStack Start Prisma SaaS Kit.

*Canonical: https://makerkit.dev/docs/tanstack-prisma/members-management/overview*

---

Members management handles who can access your organization and what they can do. The system includes viewing and managing members, sending invitations, assigning roles, and enforcing permissions.

## Key Capabilities

| Feature | Description |
|---------|-------------|
| Member list | View all organization members with their roles and join dates |
| Role management | Change member roles or remove members from the organization |
| Invitations | Send email invitations with role assignment |
| Role-based access | Three default roles (owner, admin, member) with configurable permissions |
| Custom roles | Create organization-specific roles through the UI (optional) |

## How It Works

The members system combines two authorization approaches:

1. **Role hierarchy** - Numeric levels determine who can manage whom. Owners (100) can manage admins (50), admins can manage members (10), but not vice versa.

2. **Resource permissions** - Each role has specific permissions for resources like `organization`, `member`, `invitation`, and `billing`. Permissions are checked server-side via Better Auth.

All role and permission configuration happens in a single file: `packages/rbac/src/rbac.config.ts`.

## Default Roles

| Role | Level | Can Manage |
|------|-------|------------|
| owner | 100 | Full control, can manage admins and members |
| admin | 50 | Can manage members, billing, and invitations |
| member | 10 | Basic access, cannot manage other members |

## Section Guide

### [Viewing Members](./viewing-members)

Display the members list, update roles, and remove members from the organization.

### [Invitations](./invitations)

Send email invitations, manage pending invites, and configure invitation policies.

### [Roles & Permissions](./roles-permissions)

Configure role hierarchy, permissions, and add custom resources/functions in `rbac.config.ts`.

### [Custom Roles](./custom-roles)

Enable UI-based role creation for per-organization roles without code changes.

### [Permissions API](./permissions-api)

Reference for `@kit/rbac` functions, Better Auth permission checks, and server function middleware.

## Quick Start

To check permissions in a server function (mutation), continue the `createServerFn`
chain from an function middleware and layer `withFeaturePermission`:

```typescript
import { authFunctionMiddleware } from '@kit/function-middleware/functions';
import { withFeaturePermission } from '@kit/function-middleware/server';

import { InviteSchema } from './invite.schema';

export const inviteMember = createServerFn({ method: 'POST' }).middleware(authFunctionMiddleware)
  .middleware([withFeaturePermission({ invitation: ['create'] })])
  .validator(InviteSchema)
  .handler(async ({ data, context }) => {
    // context.user is set; the user is guaranteed invitation:create permission
  });
```

Call it from the client with TanStack Query:

```typescript
import { useMutation } from '@tanstack/react-query';

const mutation = useMutation({ mutationFn: inviteMember });
```

To check if one role can manage another:

```typescript
import { canTargetRole, ROLE_HIERARCHY } from '@kit/rbac';

// Admin (50) can manage member (10)
canTargetRole('admin', 'member', false, ROLE_HIERARCHY); // true

// Admin (50) cannot manage owner (100)
canTargetRole('admin', 'owner', false, ROLE_HIERARCHY); // false
```

This members management system is part of the [TanStack Start Prisma SaaS Kit](/prisma).

---

**Next:** [Viewing Members](./viewing-members)