Your team and their roles

Your team lives under Access & Security → Users & Roles. Opening it needs the View org members permission; a Viewer cannot open it at all and is told “Your role does not include access to team members.” Changing anything on it needs Manage custom roles, and without that a banner reads “You have read-only access. Contact an Org Admin to manage users and roles.”

Under the heading you get either “N of M seats used” or “N members · unlimited seats”, then two tabs — Members and Pending Invitations — each with a count. The list refreshes itself every 30 seconds and whenever you come back to the tab.

Export downloads your member list as a spreadsheet file with each person’s name, email, roles, status, whether they have two-factor authentication enrolled, when they were last active and when they joined.

Inviting colleagues

Press Invite members.
Type addresses into Email Address(es), pressing Enter or a comma after each. Each one becomes a removable pill, so you can invite several people at once.
Choose a Role. The three built-in cards are Org Admin, Staff and Viewer; any custom roles you have built appear below them.
Add a personal message if you want one.
Send. You get Invitation sent to <email> or N invitations sent, and the view switches to Pending Invitations.

If you add more addresses than you have seats, a Not enough seats warning appears before anything is sent, with an Upgrade Plan → link. If the server refuses the send, the message is Seat limit reached. Inviting someone who is already a member is not an error — you are simply told.

Pending invitations

The table shows Email, Role, Invited by, Sent and Expires, and each row has Resend and Cancel.

What happens	Detail
Expiry	7 days. In the last 24 hours the column turns amber and counts down in hours; after that it reads Expired.
Resend limit	Each invitation can be resent a fixed number of times — “Resend limit reached (N max). Cancel and re-invite if needed.”
Resend cooldown	You must wait between resends — “Please wait N minutes before resending again.”
Cancel	Removes the invitation immediately and frees the seat.

An expired invitation cannot be revived. Cancel it and invite the person again.

What your colleague sees

They follow the link in their email, and the page asks for whatever it needs:

They already have a Sqoura account — they enter their existing password.
They do not — they set a full name and a password of at least 12 characters, with a strength meter beside it.

The screen then reads You’re in and names your organisation, and they are signed in straight away. There is no separate login step.

An expired or already-used link shows Invitation expired; a broken one shows Invalid invitation. In both cases the only way forward is a fresh invitation from you.

The built-in roles

Roles are additive. One person can hold several, and what they can do is everything their roles allow put together. Granting a role never removes one.

Org Admin

Everything. Org Admin holds every permission and cannot be restricted — the panel says so plainly with “Org Admin always has full access and cannot be restricted.”

Staff

The standard operational role, for the people who actually run your competitions.

Area	What Staff can do	What Staff cannot do
Applications	View, approve, reject, bulk approve, bulk reject, create walk-in registrations, edit, export, and read and add internal notes	Delete somebody else’s internal note
Forms	View, create, edit, publish, close, reopen, manage templates	Delete a form
Payments	View, review payment slips, record offline payments, resend invoices, export	Issue a refund through the payment provider
Tournaments	View, create, edit (including a published one), change status, generate draws, publish draws, record weigh-ins, record check-in, record results	Delete, make breaking changes, finalise results, correct a finalised result, manage defaults
Seasons	View and manage	Change advancement rules
Qualification	View, override a place	Publish qualification
Athletes	View, manage document links	Merge two athletes
Scanning	Pair a scanning phone
Organisation	View members, view settings	Anything else

Viewer

Read-only, and narrower than people expect. A Viewer can view applications and their internal notes, forms, payments, tournaments, seasons, qualification, athletes and your organisation settings. Nothing else — and note that a Viewer cannot see your member list.

Separations worth knowing

Some things that look like one job are deliberately two permissions, and these are the ones people ask about:

Recording a refund you handed over yourself is separate from issuing a refund through the payment provider. Only Org Admin has the second by default.
Recording a result, finalising it and correcting a finalised result are three different permissions.
Overriding a qualifying place is separate from publishing qualification, because publishing is what tells the athletes.
Generating a draw is separate from running a weigh-in, matching the split between the chief registrar and the scheduling group.
Recording check-in is separate from editing the tournament, so the desk you staff on the morning cannot rewrite your category structure.
Seeing identity numbers is admin-only by default, precisely because Staff can already view and export entries.
Pairing a scanning phone is its own permission, separate from reading entries.

Custom roles

Press New Role in the left column of Access & Security → Permissions. Getting to that section needs Manage custom roles.
Give it a Role name (up to 80 characters) and an optional Description (up to 255), then Create role.
The role is created holding nothing. Tick what it should hold in the right-hand checklist — whole sections can be ticked at once.
A footer appears reading “You have unsaved permission changes.” Press Save changes and you get Permissions saved.

Edit details changes the name and description. Delete removes the role, and if anyone holds it you are made to reassign them first — the dialog names how many people are affected and offers Reassign affected members to Org Admin, Staff, Viewer or another custom role.

The checklist is generated from what the server actually enforces, so it is always the truth about what a permission does. Dangerous permissions are flagged in it. Some imply others — granting Invite org members, Manage org members or Manage custom roles carries View org members with it, and Manage org settings carries View org settings.

How many custom roles you get depends on your plan: Free 1, Club 3, Federation 10, Enterprise unlimited. Your usage against that shows on the Usage card in Organisation settings.

Changing someone’s role

On the member’s row press the dashed + role chip, or open the ⋯ menu and choose Grant role.
The dialog explains “Add an additional role to <name>. Existing roles are not removed.”
Pick a Role from the ones they do not already hold.
Optionally set an Expiry, as a date plus an hour and minute. Leave it blank for permanent. An expiry in the past is refused, and a role due to expire within 24 hours carries a small clock on its badge.
Optionally give a Reason. The label tells you it is written to the audit log, and it is worth writing.
Press Grant role.

To take one role away from someone who holds several, hover its badge and press the small ×. You are asked to confirm — Revoke <role> role? — and offered a reason box that is also written to the audit log.

Two refusals you may meet: “Cannot revoke: this is the last admin in the org.” and “Cannot revoke: member must hold at least one role.” Both are enforced by the server — an organisation always keeps at least one active admin, and a member always keeps at least one role.

A role change takes effect on that person’s next request, not instantly in a tab they already have open.

Deactivating and removing

The ⋯ menu on each row also offers:

Action	What it does
`Role history`	Every grant and revocation for that person — who did it, when, the reason given and any expiry, 20 at a time.
`View activity`	What that member has been doing.
`Deactivate`	They lose access immediately and can be brought back later. Needs a second-factor code. Refused with “Cannot deactivate: last org admin.”
`Reactivate`	Restores a deactivated member.
`Remove member`	“This permanently removes them from the organisation. All role grants will be revoked. This action cannot be undone.”

Ticking the checkboxes reveals a bar reading N selected with Deactivate, Remove and Clear for doing the same to several people at once.

Finding people

Above the table are a search box (“Search by name or email…”), a role dropdown starting at All roles, and a status dropdown offering All statuses, Active and Inactive. Name, Email and Last active all sort, and pages hold 25 members.