Getting into the platform

Create your organization

Creating an organization takes about two minutes and goes through nobody. There is no approval queue, no activation call and nobody on the other side releasing your account: you finish signing up already as Admin, with full access.

Signing in for the first time

The app lives at orionworkers.com (in English, orionworkers.com/en). On the home page, Orion asks who it will work for ("For me" or "For my company"). "Sign in", at the top of the page (on a phone it may show only the person icon), opens the screen used both to create an account and to sign in.

You sign in with your Google or Apple account, or with your email. With email, use the password you created when you signed up or ask for a one-time code, sent to your inbox. Forgot your password? On the sign-in screen, the platform sends you a code to create a new one. When you sign in with a password on a new device or browser, it may also ask for a code sent to your email, to confirm it is you.

To create the account with email, the platform asks for your email and a password, and confirms the email with a code. First and last name are optional, and it does not ask for your phone or country. What it knows about you in the first second is your email (and the name and photo Google may already have sent).

You can also create the account in the mobile app, without going through the site — see In the mobile app, just below.

In the mobile app

The Orion Workers app (App Store and Google Play) signs you in to an account that already exists, and it also creates the account of anyone who does not have one yet. Sign in with Google, with Apple (on iPhone and iPad) or with your e-mail — in that case a 6-digit code arrives in your inbox, valid for 10 minutes. If there is no Orion account for that e-mail yet, the app shows the "Create your Orion account" screen: check the e-mail, enter your name (when Google or Apple provide it, it comes filled in), tick the box "I am 18 or older and I accept the Terms of Service and the Privacy Policy." and tap "Create my account". Without the name or without the box ticked, the account is not created. You have 15 minutes to confirm: after that, the app tells you the request has expired, and you just sign in again.

An account created in the app is born already set up: an organization with your name, you as Admin, one team — "Geral", with the phone in Portuguese; "General", in the other languages — of which you are the manager, and your Orion. It is born with no channel plan and no charge, it does not ask for a card, and it already starts the Y Managers 14-day free period, which counts as a subscription. The app does not ask the site's two signup questions, nor your country (see The country nobody asked about). On the home screen, a welcome card tells you the time zone that was set, where to change it (the Owner tile) and when the trial starts, with the "Connect WhatsApp" shortcut; and Orion sends a welcome e-mail to the account's address.

The channel's free trial starts when you connect your first messaging channel — WhatsApp or Telegram —, not when you tap the microphone; the Y Managers free period, on the other hand, already started when you created the account. Until you connect a channel, voice waits: when you tap the microphone, the app tells you what is missing and offers the "Connect WhatsApp" shortcut. Text conversation — "Search or ask Orion…", at the top of the home screen — already works, in the Y Managers free period.

Situations worth knowing:

• You already have an account, with another e-mail. On the create-account screen, tap "I already have an account: sign in with another email" and sign in with the e-mail of your account. It happens to people who choose to hide their e-mail when signing in with Apple: Apple gives Orion a relay address, not the e-mail of your account — the app tells you when that is the case. And it happens to people who sign in with the contact e-mail in Orion → Boss, when it is not the one they sign in with: for the app, that is an e-mail with no account.
• You created a second account by mistake. It is born empty. Delete that account in the app itself (Home → Danger zone → Delete account) and sign in again with the e-mail of the right account.
• You were called into an organization. If an Admin registered your e-mail under Users and you haven't signed in yet, the app shows the invitation — "Jane Doe invited you to join Acme Inc.", with "Join Acme Inc." and "Decline" — and you only join if you accept. If you decline, the e-mail is free for you to create your own account.
• The app says the account can't be created right now. Try again later, or create the account here, on the site, and then sign in on the app.
• The app says there is no Orion account for that e-mail and tells you to create it on the site, instead of showing the create-account screen. Update the app in the store and try again — or create the account here, on the site.
• The code didn't arrive, or you asked for more than one. The app sends at most one code a minute to the same e-mail: asking again before that doesn't send another one, and the code that already arrived stays valid for its 10 minutes — check your spam folder too. Up to 5 codes a day go to the same e-mail. From the same network (the same Wi-Fi, for example), up to 10 codes an hour go out, counting every account: in a team signing in together for the first time, whoever gets no code can sign in with Google or Apple, or ask again an hour later. Rarely, for security, codes stop going out for everyone until the day turns (midnight UTC): if no code arrives, sign in with Google or Apple.
• The app says sign-in with a code is paused for this e-mail. After 10 codes typed on the same day for the same e-mail, sign-in with a code is paused for it, for security — even with the right code. The pause never lasts more than a day: try again later, or sign in with Google or Apple (on iPhone and iPad) with your account's e-mail.

To sign in, what counts is the e-mail of the account, the one you sign in with. An app session lasts 30 days. When it ends — or when a security update closes the old sessions —, the app says "Please sign in again" and goes back to the sign-in screen: sign in again with the same Google, the same Apple or the same account e-mail. If an Admin removes the person from the organization — or the organization is deleted —, their app session ends on the next tap, and that e-mail no longer signs in to the account; once the Admin restores them, they sign in again as before.

Y Managers in the app. On the app's home screen, right below the search, the Y Managers card shows how many items are waiting on you and opens the Y Managers screen. At the top of it is Waiting on you: plans to sign, cycles to assess, reports to send and notifications. Then come, as tiles, Dashboard, Deliverables, Team Plans, Work Plans and Reports, depending on your role (see Where each role lands in the sidebar). Last, in a single row, Settings opens Organization, Users, Teams, Grouping, Billing and My Profile, also depending on your role. Each item opens the site's page inside the app — except Billing, which opens the site in the phone's browser, already signed in to your account — and the "Y Managers" button at the top goes back to that screen. To sign out in the app, Log Out is at the end of the home screen and asks for confirmation first. The card is for people whose plan includes the team panel; on plans without it (Orion Light, the free Orion BYOK and, for clients in Brazil, Orion MEI and Orion MEI+) it appears locked. Without a subscription (a member without a seat, or an organization without a subscription) the card shows Read only: you can look at everything, but not sign, assess or create. An Admin sorts this out in Settings › Billing; everyone else asks their Admin.

The two questions at signup

Signing in with no organization, two screens appear — and only two.

1. "Create your workspace". It asks for one field: the workspace name — in the rest of the panel it shows up as your organization. No tax ID, address, company size or industry. The panel opens in the language of this screen; to change it later, use EN · PT · ES · FR in the sidebar.

2. "What do you want to solve first?" Two buttons, one click:

• "Get an AI manager on WhatsApp" — Orion runs the day-to-day, chases deadlines and brings you what needs your decision. It is the highlighted one, marked Recommended.
• "Organize deliverables and the team" — Team priorities per period, each person's contribution, deadlines and per-cycle assessment.

That choice decides where you land: whoever answers "Organize deliverables and the team" opens on the deliverables dashboard; whoever answers "Get an AI manager on WhatsApp" opens on Orion. It is a front-door decision, not a plan you bought — no feature is hidden, and you can change it later. As the screen itself says: "Nothing gets locked — the rest is there whenever you want it."

Neither screen asks for a credit card. What each plan does, and what it costs, is at /pricing. The organization is born already in the Y Managers 14-day free period, which counts as a subscription: creating, signing and generating in Y Managers, Ask Orion and the AI manager work from the first minute. The free trial of an Orion channel — WhatsApp or Telegram — is a different one, and it starts when you connect your first channel (Connecting Orion); what happens when the free period ends is in No subscription.

The country nobody asked about

You never tell it what country you are in. The platform infers it from your browser's time zone and language, at the moment the organization is created:

• a Brazilian time zone (São Paulo, Recife, Manaus, Fortaleza…) or a browser in Brazilian Portuguese (pt-BR, or just pt) → Brazil, in reais — this rule comes before the others;
• a time zone of another country the platform recognizes (New York, Toronto, Mexico City, Bogotá, Lisbon…) → that time zone's country, in dollars;
• any other time zone in the Americas or in Europe → no country is asserted, and billing is in dollars;
• any other time zone, or none → no country is asserted, and billing asks when the time comes (with the browser in another Portuguese, such as pt-PT, billing goes to the Brazil account, in reais).

If the account is created in the WhatsApp conversation, the number decides. A number from Brazil (one that starts with 55), or anyone who said they are a MEI, starts in Brazil, in reais. Any other number starts with the number's country, in dollars, in the language the person wrote in (if that cannot be told, the language of the number's country) and in that country's main time zone. In the welcome message Orion says which time zone it assumed; to correct it, just tell it the name of a large city near you or your difference from GMT.

If the account is created on the website, outside Brazil, Orion starts in the language you use in the dashboard and, the first time you open an Orion page in the dashboard, in the time zone of the device you opened it on (computer or phone) — or in the time zone you had already picked in your profile. It does not change a time zone or a language you picked or told it — with one exception, only in accounts created before the October 2026 update: if, before it, you had asked Orion for Brasília time in the conversation, or picked it in Orion → Boss, the time zone may switch to your device's (or to your profile's time zone, if there is one) the next time you open an Orion page in the dashboard; if that happens, just tell it again or pick the time zone in Orion → Boss. If the country of the address in your profile is already Brazil when you first open Orion, it stays on Brasília time. To correct it later, use Orion → Boss or tell it the name of a large city near you.

If the account is created in the mobile app, the country and the currency follow the list above, with the phone's time zone and language in place of the browser's. Orion is born in the phone's time zone and in its language, when it is Portuguese, English or Spanish, and the welcome card on the home screen tells you the time zone that was set. To change it, tap the Owner tile in the app — it is the same page as Orion → Boss in the dashboard.

This is not cosmetic: that inference decides which billing account your organization will be charged on — the Brazilian account in R$ or the Canadian one in US$ — and the first purchase — by card or by Pix — locks the organization onto that account. Hence the house rule: the billing screen always shows the currency before charging, and lets you correct it — the account's country can be corrected on the Billing page until the first purchase (if a payment page is still open, the change may be refused for a few minutes). If you created the organization while traveling, check the currency before you subscribe.

What the platform sets up for you

When you finish signing up, your organization is already set up:

An active organization

created and active on the spot, with the name you gave it.

You as Admin

the highest org role, with access to everything (see Roles and permissions).

A team called "General"

it is already your home team, and you are already its manager. You do not have to create your first team to get started — and you can rename "General" or create others whenever you want.

Your worker record

this is what work plans belong to. Every registered human gets one.

You as the organization's primary contact.

The old manual said that, after creating the organization, "you are not assigned to a team". That stopped being true: you are the manager of General before you touch anything.

"First steps"

On both home screens (the deliverables dashboard and the Orion home screen) there is a card called First steps, collapsed by default, showing a progress ring and "x of y done".

It is not a tour with checkboxes. Every line is derived from the organization's real state, computed on the server: a step is checked because the WhatsApp number is in fact connected, because the deliverables plan is in fact signed — never because someone clicked "got it". Each screen shows the steps that get resolved there:

While a step is pending, it shows why it matters ("No team means nobody to delegate to and nobody to chase"). When every step on one of them is done, the card disappears from there on its own.

A scope detail: First steps only appears for Admins. Whoever joins an already-built organization configures nothing and does not see the list.

See a company running before you decide

Whoever is invited to an organization sees the shortcut on the invitation screen: "Before you start, see a working sample organization", with the 🎬 button — and whoever is creating their own organization reaches the same demonstration from the 🎬 View demo button, which sits at the top of every screen once they are in (below). The shortcut drops you inside a demonstration organization — Aurora Digital — with about six months of work on record: three teams, a dozen people and two AI workers; deliverables in every situation (on time, rescheduled, overdue, completed, cancelled); work plans that say what each person will do and what they did in each cycle, with the assessment and its justification; the Situation already written; and the Dashboard with history to compare periods and follow the trend.

Two things to know: that organization is read-only (the server refuses any write), and the way out is a fixed banner at the top of the screen. The one exception is the ✨ button on the Situation (Refresh, or Generate when there is none yet): it works, and whoever clicks it pays — the AI usage goes to your organization's AI allowance, as if you generated it there. Without a subscription, or without an organization yet, the button shows the 🔒 with the reason, the same one you would see in yours. The generated Situation replaces the one that was there and stays for whoever visits next, until the demonstration is restored (once a day). It opens in the language of the screen — Portuguese, English or Spanish — with the same teams, people, deliverables and plans in all three; to see it in another language, leave the demonstration, switch the language and enter again. The shortcut does not appear inside the mobile app.

And the shortcut is not left behind once you have signed up: in the browser, the 🎬 View demo button stays at the top of every screen, for anyone signed in — including whoever joined the organization at someone else's invitation. It is how you show a colleague what a company looks like with all the work on record. It disappears while you are inside the demonstration, because there the top belongs to the exit banner.

Join an existing organization

If someone already created the organization and you were called into it, the path is short — but it carries a consequence worth reading before you click.

There is no invite code

Let us get this out of the way first, because the old manual said the opposite in five places: there is no invite code. Nobody generates a code, nobody shares a code over WhatsApp, and there is no "join a team" screen where you type something in.

The invitation is always by email, and the person inviting is always an organization Admin — on the Users page, by typing your address. A team manager invites nobody from outside (see Roles and permissions).

There is another code on the platform, and it gets you into nothing. It is an Orion partner's referral code, which the customer enters at the moment of subscribing — it invites nobody, gives access to no organization and changes no price. It is described in Plans, leaving, and glossary. To join an organization, the path is email, and only email.

From there, what happens depends on a single question: does your email already exist in some organization on the platform?

Path 1 — your email is new here

The Admin registers your email in Users, choosing, right there, your org role, your home team and your role in that team. Your record is prepared, waiting for your acceptance — in Users it shows as Invitation pending — and you get an email with the sign-in link (if you already have an account at that address, just sign in with it as usual).

The first time you sign in with that email — at orionworkers.com or in the app — you see the "You've been invited" screen, with [ Join Acme Inc. ] and [ Decline ]. Nobody joins an organization without accepting. If you accept, you get the record the Admin prepared, with the role and team they chose. If you decline, that record leaves the organization (it goes to the removed users) and your email is free: you can create your own workspace with it.

Path 2 — you already belong to another organization

Here the platform takes a different path, on purpose. Since an account belongs to one organization at a time, the Admin cannot create a second record for you: the system creates a pending invitation and sends an email written to explain exactly that.

Since you still sign in to your current organization as usual, the invitation does not open a screen of its own: it shows up as a banner at the top of the page — on any page in the app, and it stays there until you answer:

> Jane Doe invited you to join Acme Inc. > Accepting will move your account from Beta Inc. to Acme Inc. > [ Join Acme Inc. ] [ Decline ]

Clicking "Join Acme Inc." still changes nothing: it opens a confirmation — "Join Acme Inc.?" — that repeats in three lines what is about to happen (your account will be moved and you will join as a member; you will leave Beta Inc., and your access and your role there will end; an admin of the old organization can invite you back later), with the buttons [ Cancel ] and [ Confirm and join Acme Inc. ].

Read the notice carefully, because it is literal. Accepting moves your account. The moment you confirm:

• you leave the organization you were in, and your access to it ends;
• all your previous team roles are terminated;
• your worker record moves to the new organization;
• your org role is reset to User, and you join as a member of the team named in the invitation.

This is not a context switch you can undo with a click: to go back, someone from the old organization has to invite you again — and you will come back as a User, without the team roles you had.

"Decline" declines the invitation, which disappears. Declining is reversible: the Admin can invite again.

A side effect that confuses newcomers: while there is a pending invitation for your email, the platform will not create a new organization for you. If your intent is to have your own organization and not join the inviter's, use "Or create your own workspace" on the invitation screen: creating your own declines the pending invitations, and the screen says so first.

And an honest check before you accept: if you are today the only Admin of your current organization, nothing blocks your exit. The old organization is not deleted, and the platform promotes the longest-standing person left to Admin — but if nobody is left, it ends up with no active owner. Promote another Admin before you move.

Weekly workload and salary: who fills them in

The old manual told you to "ask your manager" to fill in your weekly workload and your salary. That does not work.

Those fields are HR's: only someone whose org role is Admin or HR can write them — on your profile they appear with a lock 🔒 and, if anyone tries from outside the screen, the server refuses. Your team's manager cannot, unless they also hold one of those two org roles.

It is worth having them filled in: the weekly workload is the basis of effort in the work plan, and compensation is what lets the organization calculate the cost of a deliverable. But the request has a correct address: an Admin or HR.

Two fields on the same card — Org role and Active — are the Admin's alone: HR also sees them with 🔒, on their own profile too, with the reason underneath.

Roles and permissions

This is the chapter that changed the most. The previous manual described this section as "inferred based on standard management-software practices" — and got it wrong on almost every line. It is not inference: these are real roles, with a closed list of values, checked by the server on every request. Below is what the platform does today.

Two layers

Everyone has one org role and, on top of that, one role in each team they take part in. The two layers answer different questions:

Org role

what you reach across the whole company — people records, settings, billing, broad reading. One per person.

Team role

what you can do inside that team — create deliverables, sign plans, assess cycles. One per team, and you can have different roles in different teams.

For reads, the org role is the stronger one: an Admin, an HR or an Audit sees the whole organization regardless of team.

And the subscription sits on top of both. The role says what you may do; the subscription, whether you can do it now. Without a subscription, or on a plan without the team dashboard, creating, signing and generating in Y Managers get a 🔒 whatever the role — for the Admin too, except the Admin of an organization that pays for the team dashboard —, and reading, editing and logging progress continue. During the organization's Y Managers free period, everyone creates, signs and generates. Who has no subscription, and the way back, is in No subscription.

The four org roles

Admin

full control. Registers, edits, deactivates and removes people; sets everyone else's org role; creates and re-parents teams; edits the organization's settings; starts and cancels the subscription; and overrides any team lock. The first Admin is whoever created the organization.

One Admin limit that catches people out

"full control" applies to the work on record, not to authorizing Orion to complete acts in the manager's place. That permission can only be granted by a manager of that team (or of a team above it). Being an Admin is not enough, and that is on purpose: Admin is a technical profile — whoever configures the organization does not authorize the AI to sign on behalf of a manager they are not. Whoever holds both roles grants it as a manager, not as an Admin. And a manager who is an AI worker never grants anything: the AI does not authorize itself.

HR

takes care of people. Opens the Users page and edits the record — compensation, contract type, work modality, weekly workload, currency, home team and skills. HR can also rewrite the wording of the 1-to-5-star rating scale, the only organization setting open to someone who is not an Admin. What HR does not do: add new people, remove people, change someone's org role — not even their own, on My Profile — or deactivate an account, their own included — that stays with the Admin. And there is no vacation, leave or time-off management on the platform; assessing a cycle is the team manager's act, not HR's.

Audit

broad reading; for writing, only its own personal notes in Knowledge. Reads deliverables, deliverables plans and work plans across the whole organization, with no team restriction. On those screens, every write attempt is refused by the server. The detail screens follow the rule: a deliverable or a work plan opens in read-only mode, with the fields locked and no action buttons. The lists do not: Create deliverable, Create deliverables plan and New work plan keep showing up for anyone signed in — the refusal only arrives when you try to save. In Knowledge, Audit only reads what belongs to the company: it reads, searches and asks the library, and the organization's items and the deliverables' items open as read only, with no ✎ Edit or 🗑 Delete. Its own 🔒 Personal notes are allowed: the new-note and attach buttons always save a 🔒 Personal item, which only that person sees and which they can edit and delete — the screen doesn't offer 🏢 Organization, 🌐 Public or a deliverable. Its Orion doesn't file anything in the company library, and neither does an AI worker working at its request: the worker hands over the material and says it wasn't saved. A fact it confirms in Radar stays in its Orion's Notes, not in the company's Knowledge. But "broad" is not "everything". People records (salaries, contracts, roles) are restricted to Admin and HR. Cost figures do not arrive either: the server only sends the number to the Admin and to whoever manages some team — and the Audit role, on its own, is neither. By the same yardstick, the Reports page does not appear.

User

the default role, and almost everyone's. On its own it gives you nothing beyond your own work: what you reach comes from your team roles.

Where each role lands in the sidebar

The bar has three groups: Orion, Y Managers (with the work sections right below it) and Settings (Organization, Users, Teams, Grouping, Billing and My Profile). In each of them, each role sees:

Reports follows a different yardstick, because it carries individual assessments: it shows up for the Admin and for whoever is a manager or assistant of some team. An HR who leads no team does not see it.

The AI Team Governance page has rules of its own. The audit trail (at the bottom of the page) belongs only to the Admin and the account owner — the organization's Primary contact —, even if they are not an Admin: HR, Audit and team managers see the page, but not the trail. The AI workers' pending approvals (the "Awaiting your approval" block) only show with their content, and can only be approved or rejected, by the Admin, the account owner and whoever leads the worker's team — manager or assistant of the team where it has its current work plan signed by both sides, or of a team above it; for everyone else, the block only shows how many are waiting and who they belong to. A worker's posture and rules belong to the same people who decide its approvals; hiring, editing and removing workers belongs only to the Admin; and the rules of the "Orion (Gerente)" row belong to the Admin and the account owner. And a reply from your own Orion in a group set to "Always ask me" is yours alone: only you see it and decide it — not the Admin, not the account owner.

The four team roles

There are four, not three — the old manual forgot the last one.

Manager

answers for the team. Creates deliverables and deliverables plans, creates work plans for the team's people, signs the supervisor line, approves or rejects edit requests and assesses the cycles. Signing and closing a deliverables plan is theirs alone (or the Admin's) — and, after the signature, only the manager (or the Admin) adds or removes deliverables in the plan.

Assistant

a member with management powers, with three sharp exceptions. An assistant creates deliverables, deliverables plans and work plans, approves and rejects edit requests — but does not sign the supervisor line, does not assess cycles and, in a deliverables plan, only adds and removes deliverables before the signature (after it, that's up to the manager or the Admin). There is a side effect that catches people out: if "assistant" is your only team role in the entire organization, you cannot sign even your own work plan, which a plain member signs without trouble.

Member

executes. Works on the deliverables, touches the tasks they act on, builds and signs their own work plan, submits the cycle report for their own plan and can request adjustments and edits. Does not create deliverables and does not assess anyone.

Observer

reading, and nothing beyond it. It was built for a mentor, advisor or outside consultant: sees the team's work plans, never counts as leadership, does not see cost figures (unless the Admin allows it, under Dashboard, cost and average rating access) and gets no write power over the team's work. The observer role is assigned on the team card, on the Teams page.

What each team role can do

The observer stayed out of the table because it would tick none of its rows: the role grants no writing.

An organization Admin passes every row of this table, in any team. Audit passes none. The exception is a deliverables plan that has ended: its list doesn't change, it can no longer be signed and no work plans are generated from it, by anyone, not even the Admin. A plan that passed its end date without being signed hasn't ended — it is still a draft.

Four things that do not fit in the table:

Creating your own work plan does not depend on a team role. Anyone in the organization creates theirs. What requires manager, assistant or Admin is creating someone else's plan.

Manager acts apply to your team's plans — and to the teams below it. Signing the supervisor line, assessing a cycle and answering a review request belong to the manager of the plan's team or of a team above it; creating someone else's plan, adding, removing and editing its deliverables (the effort, the promise and the ticked tasks), requesting an adjustment on someone else's plan (before the agreement), approving or rejecting an edit and deleting someone else's plan, to the manager or the assistant of that same chain. The manager of a sibling team — or of a team below the plan's — doesn't act on those plans. The deliverables plan follows the same chain: signing and closing it belongs to the manager of the plan's team or of a team above it; adding and removing deliverables and generating work plans, to the manager or the assistant of that chain (on a signed plan, only the manager adds and removes). Recording or correcting a decision on a plan — work plan or deliverables plan — belongs to the manager or the assistant of that same chain (on a work plan, also to the person themselves). The organization's Admin passes all of them.

Self-managed plans are by design, not a loophole. A manager who is also the plan's participant satisfies both conditions and signs both lines of their own plan — participant and supervisor — with no second manager. In small organizations, where the manager is the one executing, this is what lets the cycle run.

Requesting an edit to an already agreed plan is the participant's act, not the manager's. Once both signatures are in, whoever reopens the plan is the person it belongs to: the request-editing button only shows up for them (and for the organization's Admin), and a request made by a manager on someone else's plan is refused. What falls to the manager is to approve or reject that request. Before the plan is agreed the yardstick is the opposite: the adjustment request is open to the manager and the assistant on any team member's plan, and it wipes the signatures already given — the plan needs both again.

One role per team

In the same team you are either manager, or assistant, or member, or observer — never two. Assigning a new role erases the previous one in that team, with no conflict warning, because there is no conflict to resolve.

Across different teams, roles are independent: you can be manager of Marketing and member of Sales.

Who sees what

Beyond the screens, there are two content rules worth knowing, because they explain why two people see different numbers on the same page.

Cost and salary are stripped on the server. By default, cost figures show up for the Admin and for whoever is a manager of some team; assistants, members and observers do not receive them — and it is not the screen hiding them: the server does not send the number. Each organization can change this: on the Organization page, under Dashboard, cost and average rating access, the Admin chooses who sees the dashboard and who sees cost, by profile and by team role. You always see your own salary, on your profile; someone else's, never, unless you are Admin or HR.

Work plans always come restricted. For someone whose org role is "User", the list shows: your own plan, always; the plans of the teams you manage or assist (including sub-teams); and the plans of the teams you observe. Whoever neither leads nor observes any team sees only their own plan. Admin, HR and Audit open any plan in the organization.

Team-level privacy

On the Organization page there is a switch called Team-level privacy, which only the Admin turns on.

Off (default)

deliverables and deliverables plans are visible to the whole organization. It is the mode for whoever wants the entire team to see what the company is doing.

On

someone whose org role is "User" only reads deliverables and deliverables plans of the teams they belong to, and their Dashboard also shows only those teams. Admin, HR and Audit keep seeing everything.

Worth noting that the switch governs deliverables and deliverables plans; work plans are already restricted by default, with or without it, by the rule in the previous section.

A role is not the same as "working on the deliverable"

There is a third axis, and it catches a lot of people out: to touch a deliverable or a task, having the right role is not enough — you need a relationship with that deliverable.

Editing a deliverable

manager or assistant of its team (or of the parent team), or Admin. Being manager of Marketing gives you no power over Sales' deliverables.

Creating a deliverable in a team

the same yardstick, applied to the team you pick.

Creating a task in a deliverable

whoever works on it — the leader of the deliverable's team, someone flagged as a candidate on one of its tasks, or whoever has that deliverable in their own work plan.

Touching a task (progress, status)

whoever acts on it, the manager or assistant of the deliverable's team, or the Admin.

Recording a decision on a deliverable

being on the team is not enough. You have to lead the deliverable's team (or the parent team) or actually work on it. On a work plan and on a deliverables plan, the manager-acts rule above applies: whoever leads the plan's team or a team above it — and, on a work plan, the person themselves.

The whole rule fits in one phrase: whoever works on the deliverable.

Who registers people

Worth repeating, because it is the old manual's most expensive confusion: bringing someone new into the organization is an Admin's act, done by email on the Users page.

A team manager can add to their team people who already exist in the organization, and set their role there. They do not open the people records, do not see salaries and do not invite anyone from outside. If you need someone who is not on the platform yet, the request goes to an Admin.

The last-Admin protection

An organization needs an owner. That is why the server refuses three moves when they would leave the organization with no active Admin:

• demoting the only Admin to another role;
• deactivating the only Admin;
• removing the only Admin.

It applies on Users and on My Profile: the only Admin cannot demote or deactivate themselves from their own profile either. And the consequences are the same through both doors: deactivating yourself or changing your own role on My Profile does what the Users page would do. Someone who deactivates themselves stops appearing in the list of people when a work plan is created, and whoever inherits the teams they managed is notified; and, if the change leaves the person without a subscription, any extra WhatsApp number request they made leaves the organization's bill.

The message is always the same idea: promote someone else to Admin first. And nobody removes themselves from the people list — removal is always of someone else.

What happens when you deactivate someone

Deactivating is not deleting. The person loses access immediately: they can no longer sign in, they stop receiving notices and reminders, and Orion stops answering them about the organization. Their prospecting stops too: nothing else goes out from their sending mailbox, and the campaigns they created are put on hold, with the contacts where they were. The Instagram service they may have connected goes quiet too: messages keep arriving on Instagram, but nobody gets a reply, no stalled conversation is resumed and no new-contact notice is sent. If they try, they see a notice saying their access is turned off and pointing them to an Admin.

Their work stays where it was — deliverables, tasks, assessments and history are not deleted. And the move is reversible: reactivate the person and access — and prospecting, where it left off, and the Instagram service — comes back exactly as it was. It works the same for an AI worker, with one billing difference: deactivated, it leaves the organization's bill (by card, its charge stops, prorated); reactivated, it comes back, but only where the organization could hire it (see The AI team): by card, it is charged again right away; when you pay by Pix Automático (customers in Brazil), if the authorized amount does not cover it, it only goes back to work once the first payment of an authorization that includes it goes through (the Billing page asks for the new amount). A Y Managers plan chosen for someone who is deactivated also waits for the person to come back: only then does it join the organization's bill.

There are three different moves, and only the last one is final. Deactivate removes access and stops their prospecting and the Instagram service they may have connected, and nothing else — reactivating brings all of it back. Remove takes the person out of the organization and switches off their Orion and their prospecting — including the Instagram service they may have connected, which stops replying and stops sending new-contact notices — but it is also reversible: restoring brings back access, Orion, prospecting and the service together. Delete is permanent — which is why the platform refuses to delete anyone who already has work-plan history: the organization's records have to stay intact — and it also disconnects the Instagram account and the prospecting sending mailbox they may have connected.