Add a person
From Settings, Personal section, “My account” screen: the “Add a person” block asks for an email address and a role, nothing else. Only the owner or an administrator can add someone. Not to be confused with adding people on your organisation map, which describes who does what without creating any access.
The addition is immediate: there is no invitation to accept, and no automatic email is sent. Tell the person yourself: they then sign in to your console with that address, as described below.
Each plan includes a number of seats. When all are used, the console says so and offers the next plan up - never overage billing. Plan details are on the Pricing page.
See pricingThe four roles
There are four roles, as the console describes them:
Full control, including who has access. Only an owner can grant or remove another owner, and billing is theirs alone.
Manages people and approvals.
Does the work, requests approvals. The everyday role.
Reads the compliance log. Included from Kastel Équipe.
When adding someone, the Owner role is never grantable: you make an owner by promoting an existing member, and only an owner can do it. To hand over an organisation, the departing owner promotes their successor then steps down; the console refuses to demote the last owner, so an organisation is never left without one.
Signing in
There are no passwords at Kastel: nothing to remember, nothing to leak. Everyone enters through a sign-in link sent to their email address - single-use, valid 15 minutes; a different link from the signup confirmation one - or with “Sign in with Google” on a verified address. A session lasts twelve hours.
If your address belongs to several organisations, the session opens on one of them and you switch from the console. Getting into your own console depends on no plan: people’s sign-in is never paid.
Three doors never to confuse
The email link or Google, described above. Always included, for everyone.
Each person connects their own AIs to your Kastel; the authorisation carries their name and can be cut anytime. Always included. The gesture is covered in the Connect your AI guide.
Your access rules driven by your identity provider. Available from the PME plan.
When your organisation enforces SSO, the email sign-in link is refused: a policy you turned on cannot be walked around through a side door. Owners keep an emergency email access: every use is written to the audit trail and reported by email to every owner. That access is structural, no configuration can remove it.