---
title: "Manage project members and policies"
description: "Add people to a TIR project, change or remove their project role, and create the policies that decide which services a Member can use."
content_type: "how-to"
product: "tir-iam"
platform: "TIR"
url: "/tir/tir-iam/how-to/manage-project-members-and-policies/"
topic: ["users-and-access"]
---

# Manage project members and policies

Choose who works in a project and which services each Member can use. Both happen in the project's
**Project Settings**: people on the **Project Members** tab, and service access on the **Policies** tab. To open
it, select **Project Settings** in the side menu while you are in the project.

To rename or delete the project, or to see its usage and activity, see
[Project management](/tir/projects/).

## Before you begin

Make sure that you are the Owner, an Admin, or a Project Manager or Project Lead in the project. These roles
manage members and policies.

<a id="members--add-project-member"></a>

## Add a project member

Open **Project Members** and select **Add Project Member**. Choose one of two ways:

| Choice                | Use it for                                                     |
| --------------------- | -------------------------------------------------------------- |
| **Add existing user** | A user already in the account who has yet to join this project |
| **Add new user**      | A person new to the account; an invitation email is sent       |

### Add an existing user

1. Select the user from the list. It shows the people in your account who are outside this project.
2. Choose the **Project Role**, from the roles below your own. A **PROJECT MANAGER** can also create projects,
   a **PROJECT LEAD** runs this project and adds Members, and a **MEMBER** uses the services its policies list.
   For **MEMBER**, choose one or more policies. To compare the roles, see
   [Roles and permissions](/tir/tir-iam/concepts/roles-and-permissions/).
3. Select **Add Project Member**.

### Add a new user

1. Enter the person's email address.
2. Choose the **Project Role** and, for **MEMBER**, one or more policies.
3. Select **Add Project Member**.

An invitation email goes to the person, and they join the project when they accept it. Follow the invitation under **Invited users** in
**Identity & Access Management (IAM)**; see [Manage users in IAM](/tir/tir-iam/how-to/manage-users-in-the-iam-panel/). A person with the **MEMBER** role
needs a policy, which decides which TIR services they can use. See [Policies](#policies).

## Change a project member's access

You can update the access of a member whose project role is below yours.

1. In **Actions**, select **Update Member Access** for the member.
2. Change the role or policy, then select **Update Member Access**.

## Remove a project member

1. In **Actions**, select **Remove Project Member** for the member.
2. Tick the confirmation checkbox and select **Delete**.

The member loses access to the project. SSH keys the member attached to the project's resources stay on them;
remove them separately.

## Policies

A policy lists the TIR services and the actions a Member can use in this project. Every Member needs a
policy. Each policy belongs to one project. Open the **Policies** tab to manage them.

### Create a policy

1. Select **Create Policy**.
2. Enter a **Policy Name** of up to 50 characters, and a **Description** of up to 500 characters. The
   description is required.
3. Under **Select Services**, choose the services and tick **Read**, **Create**, **Update**, or **Delete**
   for each. **Select All Services** ticks every service, and the search box finds one.
4. Select **Create**.

### Edit a policy

In **Actions**, select **Edit Policy** for the policy, make the changes, and select **Update**.

### Delete a policy

1. In **Actions**, select **Delete Policy** for the policy.
2. Tick the confirmation checkbox and select **Delete**.

Deleting a policy removes the permissions it gave to the members who use it, so they lose access to those
services. Give those members another policy before you delete it.

If a member sees a permission message, see [Troubleshooting TIR Access Control](/tir/tir-iam/troubleshooting/tir-iam/).