You shouldn't share an API key over Slack. v1.4 ships team management: invite teammates, assign roles, and see exactly which key spent which dollars.

Four roles, scoped at org + team

Role	Can do
Owner	Everything, including billing, transfer ownership, delete the org
Admin	Manage keys, guardrails, prompts, budgets, invite + remove members. Cannot touch billing.
Member	Create + rotate their own virtual keys, view org analytics, run the playground
Viewer	Read-only across the dashboard — useful for finance, security, exec stakeholders

Roles map cleanly to LiteLLM's role hierarchy under the hood (proxy_admin → owner, org_admin → admin, internal_user → member, internal_user_view_only → viewer). One UUID, one source of truth.

Tenancy is org → team → member

Per Rule #26, every user belongs to exactly one organization AND exactly one team within that org. Every org auto-provisions a Default team at creation. Multi-team membership per user is intentionally out of scope until customer demand emerges — the path to "change teams" is leave + rejoin.

This sounds restrictive; it's a deliberate simplification. Spend attribution, RLS policies, and budget enforcement all become unambiguous when a user has exactly one team identity.

Invitations

Owners and admins send invites from /{org}/team:

Email + role + optional target team (defaults to the inviter's team)
One-time link, 7-day expiry, single-org-per-user enforced at accept time
Audit-trail entry on every accept / decline / expire

# Or via the API, if you're scripting onboarding
curl https://nemorouter.ai/api/supabase/invitations \
  -H "Authorization: Bearer sk-nemo-..." \
  -d '{ "email": "alice@acme.com", "role": "admin" }'

Per-virtual-key spend (v1.3) tells you which member is driving cost. Per-team budgets (v1.5 follow-up) let you cap it.