Set up your team
This guide takes a new deployment from no accounts to a team working in one workspace. It assumes cairn is installed with auth on (see Install and deploy).
1. Create the first account
Section titled “1. Create the first account”Open /console/signup and enter your company name, your work email and a
password, or use Continue with GitHub / Continue with Google if the
deployment offers them.
On a deployment with no accounts yet, the first person to sign up always gets
in, whatever the sign-up mode, and becomes the owner of a new account.
That is how the first admin exists on an invite-only install. After that,
OBS_SIGNUP decides who else can sign up (see Sign-up and
sign-in).
2. Set up the workspace
Section titled “2. Set up the workspace”A new account opens on a guided setup page before the console. Progress is read from what the workspace has recorded, not from clicks, so you can leave and come back.
| Step | What you choose | Default |
|---|---|---|
| Account | created at sign-up | done |
| Workspace | created at sign-up, named after your company | done |
| Environment | Sandbox (no keys, no cost; flows run on simulated operators) or Production (real model and GPU providers, connected in Integrations) | Sandbox |
| Starter pipelines | goals: Fine-tune a model, Prepare a dataset, Serve and batch inference, Estimate cost. Each goal enables a few pipelines; Browse all pipelines lists every one, with search. Nothing is launched or paid for. | Fine-tune a model |
| Team & defaults | optional: invite teammates and set a budget cap per run. Skip for now accepts the defaults. | $50 per run; you are the approver |
| Ready | a summary and Start your first run | — |
Pipelines that run on a schedule start unchecked: enabling one arms its schedule.
Only an owner or admin can save these steps. Everything chosen here can be changed later: the environment in Settings › Environments, the pipelines on the Pipelines page, and budget, approvers, notifications and retention in Settings › General › Workspace defaults.
3. Invite people
Section titled “3. Invite people”Invites are how people join on an invite deployment, and they work in every
mode.
- Go to Settings › Internal users (visible to owners and admins).
- Choose Invite someone, enter the email and a role.
- Copy the link it shows and send it yourself. It is shown once; cairn stores only a hash of it.
The link opens /console/invite/<token>, where the person sets a password and
joins your account with the role you chose. An invite expires after 72 hours
and can be revoked from the same page. You can also invite people from the
setup page’s Team step: each email gets an invite link.
Add user directly creates an account with a password you set, for people who won’t receive an email.
4. Roles
Section titled “4. Roles”| Role | Can |
|---|---|
member | run pipelines, decide gates, and see the workspace’s runs and records |
admin | everything a member can, plus invite and manage users, save workspace setup, register the account’s domain, and change governance settings: policies, environments and profiles, backends, connections, triggers, models, knowledge and feature flags |
owner | everything an admin can. The person who created the account is its owner. |
A gate’s approvers names who is asked to decide; it doesn’t yet restrict who
can. See Gates and approvals.
Disabling a user is soft: they can no longer sign in, but their runs, approvals and audit entries keep their name.
5. Let colleagues join by domain
Section titled “5. Let colleagues join by domain”With OBS_SIGNUP=domain, anyone whose work email matches your account’s
registered domain can sign up on their own and joins your account as a
member. No invite needed.
Sign-up registers your company’s email domain automatically, unless it’s a personal-mail domain such as gmail.com. To register or change it yourself, go to Settings › General › Account domain (admins only). A domain another account already holds is refused. An admin can register a personal-mail domain there explicitly, but then anyone with an address at that provider can join, so do it only if you mean it.
6. Sign in with GitHub or Google
Section titled “6. Sign in with GitHub or Google”Once the deployment has a provider configured, the buttons appear on both the
sign-in and sign-up pages. Signing in with a provider uses the verified email
it returns. It doesn’t bypass the sign-up mode: under invite, an email with
no account still needs an invite.
- Gates and approvals: what approvers decide, and where.
- Run your first pipeline
- Connect a model or GPU provider