Members & roles

Roles, invitations, and removal all live on the Members settings pane.

Scope
Who can do it	Owners and admins manage members; members cannot
Applies to	Cloud and self-hosted
Requirement	A team organization
Affects	A user's membership, and the organization's seat count

Roles#

Every member has exactly one role. There are no separate groups or teams.

Role	Can do
Owner	Everything an admin can, plus promote or demote other owners.
Admin	Manage org settings, invite and remove members, change member roles between admin and member, install the GitHub App, and edit the agent policy.
Member	Use workspaces, repositories, and agents in the organization. Cannot change org settings, members, or policy.

The API enforces these:

You cannot modify your own membership — not your role, not your removal.
The last owner cannot be removed or demoted. An organization always keeps at least one owner.
Only an owner can change another owner's role. Admins move people between admin and member; promoting to or demoting from owner is owner-only.

Self-hosted deployments add two lockout-prevention rules for the instance organization:

A user whose email is listed in ADMIN_EMAILS cannot be demoted below admin while that email remains listed.
The last active instance admin cannot be removed or demoted.

Invitations#

Invite from the Members pane by entering an email address. The role dropdown offers Member and Admin.

Owner is not an invite option. An owner promotes someone to owner after they join, by changing their role.
Invitations are email-specific. The join is scoped to the invited address; a person signing in with a different email cannot accept it.
The copyable join URL is an entry point for the invited person, not a grant. Possessing the URL does not make someone a member — they still have to authenticate as the invited email.
Pending-invitation row actions are Copy link and Revoke. There is no Resend action.

Removing a member#

Removing a member changes their membership state and adjusts the seat count.

Careful

Removal does not kill their running sessions, revoke every credential they hold, or clear organization secrets already materialized for them. To invalidate access immediately, rotate those secrets yourself.

On Cloud, bringing someone back needs a fresh invitation. Self-hosted is the exception: an email on ADMIN_EMAILS is reinstated as an instance admin at its next login, so offboarding a listed user means removing them from that list too.