Users, roles, and groups

Administration commands require the admin or global_admin organization role. See Command reference for exact syntax, exit codes, and error codes; this page explains the rules behind them. For definitions of group, group role, group invitation, ownership, and admin override, see Glossary.

Roles

Role	Organization administration	File content
global_admin	Unrestricted bootstrap and administrative authority	Exceptional access is explicit and audited
admin	Users, roles, Root Folders, metadata definitions, audit retrieval, group discovery/oversight	Organization-wide content access is unconditional and always audited; a reason is optional
user	No organization administration	Access through ownership or valid grants

The first verified account matching the configured bootstrap identity receives global_admin through a server-side auditable process. Later registration is invitation-only — see Invitations for how administrators send and manage invitations.

List, deactivate, reactivate, and re-role members

tv admin user list
tv admin user deactivate person@example.com
tv admin user reactivate person@example.com
tv admin user role person@example.com admin

tv admin user list shows every organization member's email, role, and status. Deactivation and re-roling both reuse the same hierarchy rule the identity module enforces everywhere: a global_admin may deactivate anyone but themselves; an admin may deactivate only a user-role member, never a fellow admin. tv admin user role is CLI-restricted to setting admin/user (global_admin is bootstrap-only and never assignable through this command); an admin actor may only change a currently-user-role subject — so one admin can never demote or promote a fellow admin; only a global_admin can. Both commands reject acting on your own account.

tv admin user reactivate <email> restores a deactivated member's ability to sign in. Reactivation sets the member's status back to active but does not restore any previous sessions or authentication tokens (those were deleted during deactivation); the member must sign in again. See Deactivation for exactly what deactivating a user does to their active sessions.

Groups

Any active organization member can create a group and becomes its sole owner — group management does not require admin/global_admin. See Access and delegation for the full self-service tv group create|list|invite|invites|accept|decline|members|remove-member|role|transfer surface. Groups are flat (no nesting), organization-local, and gain access to files only through explicit access grants.

What administrators see and can do

Administrators never gain implicit membership in a group they did not create or join, but they can always discover and, when necessary, intervene:

tv admin group list
tv admin group members finance-team
tv admin group remove-member finance-team person@example.com
tv admin group transfer finance-team newowner@example.com

• tv admin group list shows every group in the organization regardless of who owns it, including whether it currently has zero active owners (needsOwnerRecovery).
• tv admin group members <group> inspects any group's membership; because an administrator is not necessarily a member, this read is always recorded in the audit log.
• tv admin group remove-member <group> <email> is a moderation action that bypasses the normal owner/manager requirement.
• tv admin group transfer <group> <email> is recovery-only: it promotes an existing active member to owner without demoting anyone, and only applies to a group with zero active owners — see Group owner recovery. There is no tv admin group create or tv admin group add-member: administrators create and join groups the same way every other member does, never silently.

Errors

• GROUP_NOT_FOUND: the group does not exist.
• GROUP_MEMBER_NOT_FOUND: the target email is not a member of that group.
• GROUP_OWNER_DEACTIVATION_BLOCKED (from tv admin user deactivate, not a group command): the target solely owns a group that still has other active members; transfer ownership first.
• FORBIDDEN: the caller is not an admin/global_admin.

What administrators cannot do

There is no permanent-delete command for a user, a group, a Root Folder, a metadata definition, or a file — every deactivation is reversible-in-effect and preserves history (a deactivated Root Folder's name, for instance, stays reserved forever so historical file references never become ambiguous). See Trust boundaries.

Continue with Root Folders and metadata or Audit and administration.