Skip to main content
ReclaimLLM enterprise uses three roles to control what each person can see and do within your organization. Admins manage the org; team leads see their teams’ activity; developers see their own sessions. Admins additionally control org-wide governance — session sharing, retention, and encryption — from the Settings tab.

​
The three roles

Admin

Full visibility across the org. Manages members, teams, settings, gateway credentials, encryption policy, and retention rules. Can see and (if permitted) open all sessions.

Team Lead

Sees sessions and analytics for developers assigned to their team. Cannot manage org-level settings or view other teams’ activity.

Developer

Sees their own captured sessions and any sessions explicitly shared with them. No access to the enterprise portal or other developers’ activity.

​
Role permissions reference

​
Adding members and assigning teams

1

Invite a developer

In the enterprise portal, open Members and click Invite member. Enter the developer’s email address and select their role. They receive an email invitation to join the organization.
2

Create teams

Go to Teams and click New team. Give the team a name that matches how your organization is structured — for example, backend, data, or platform.
3

Assign a team lead

Open the team and click Assign team lead. The team lead gains visibility into all sessions attributed to developers on that team from the moment of assignment forward.
4

Add developers to the team

From the team page, add developers by selecting them from your org member list. Once assigned, sessions they capture are attributed to that team in org analytics.
5

Backfill historical sessions (optional)

After assigning a developer to a team, you can trigger a backfill to attribute their previously captured sessions to your org. This ensures analytics reflect their full history, not just sessions captured after joining.
A developer can belong to one team at a time. Reassigning them to a new team updates attribution for future sessions; historical session attribution is not retroactively changed.

​
Org-wide governance settings

Beyond roles and team assignment, admins configure org-wide governance from the Settings tab: data retention and legal hold, session sharing scope (org-wide vs. team-only), org-wide session encryption and admin decrypt access, and project name normalization. See the Settings tab reference for the full breakdown of each control.

​
SSO (SAML/OIDC)

SSO configuration is available in the enterprise portal under Settings → SSO. The following reflects the current state:
  • Store SAML or OIDC provider configuration for your organization.
  • Test the SSO connection from the portal.
  • Allow members to sign in via your identity provider.
If SSO enforcement is critical for your deployment, contact [email protected]. We can prioritize configuration support for your identity provider while the enforcement feature is in development.

​
Admin controls in the enterprise portal

The enterprise portal collects all org-level admin controls in one place. As an admin, you can access the following from the portal:
Invite new members, change existing member roles, and remove members from the org. Role changes take effect immediately.
Create, rename, and delete teams. Assign team leads and add or remove developers from any team.
Control whether members can view and search sessions across the whole org, or only within their own team. Sharing is always read-only — members can never edit, delete, or share a session they don’t own.
Rename or merge project names org-wide. Org-level mappings take precedence over each member’s own personal project naming, everywhere a project name is shown.
Enable or disable org-wide encrypted raw session storage. Configure whether admins and team leads can open encrypted session details for org members.
Set configurable retention windows for session data. A background task enforces deletions across session records and blobs on the schedule you define.
Store provider credentials, create and revoke team gateway keys, and configure provider and model policy per key. See LLM Gateway for full setup instructions.
Store and test your SAML or OIDC provider configuration. Enforced SSO is in development.

​
Next steps

LLM Gateway

Issue team-scoped gateway keys and control provider access.

Observability

Use role-scoped analytics to monitor usage across teams and developers.