# Users

> Users lists the people of one server at a time. Invite someone by email in a role; pick a person to change their roles, add an exception, suspend them without losing anything they did, or delete them. Looking at Live is logged.

Source: https://sapilon.com/docs/project/users
Last updated: 2026-10-16

---

**Users & sign-in** (Explorer → How It Works) is where you see and manage the people of your app. It needs an
app that people sign in to; an app without sign-in has no users. The page has two tabs: **People**
and **Roles**.

## Who appears, and on which server

Each server has its own people, so the tab starts with a server picker — the Build Server, and the
Rehearsal and Live Servers once your project has them. Your choice is remembered per project.

- **Build Server** — the test users of the sign-in page. Inviting one creates a test user in the role
  you choose and sends no email, so you can try "an invited Finance user" before you publish.
- **Rehearsal and Live Servers** — real people. A person appears once they have an account, or while
  their invitation is waiting.

If a server can't be shown, the tab says why and offers the way forward: **Update the platform** (the
server runs an older platform), an **Ask the Agent** hand-off (the app has no roles yet), or **Start it**
(the Rehearsal Server is stopped). An expert helping you on Rehearsal sees the list read-only, with
email addresses masked.

## Inviting people

**Invite people**, at the top of the page, takes a name, an email address and a role. The person gets
an email and joins in that role the first time they sign in — which signing up on their own can't do.
If your app is invite-only this is the only way in.

An address that already has an account, or a waiting invitation, is refused with the reason. A
waiting invitation can be **sent again** (its seven days start over) or **revoked**.

## Roles and exceptions

Pick a person in the list and their details open in the panel on the right: email, status, the date
they joined and when they last signed in. Tick or untick roles there to give or take them away — each change saves at once, with an undo — and to add an
**exception**, such as "Sam can't delete invoices". **Check access** answers "Can Sam approve invoice
42?" and shows which setting decided. See [Roles and permissions](./roles-and-permissions.md) for
how roles and denies combine.

The last admin can't be taken out of Admin, suspended or deleted: make someone else an admin first.

## Suspend or delete

**Suspend** means "this person can't use the app any more, but keep everything they did". They can't
sign in again and lose access within 30 seconds. Their roles and exceptions are kept, so **Restore**
brings back exactly what they had. Each person's panel lists the last twenty changes made to them.

**Delete** removes the person's account, roles, exceptions and sign-in for good; they can only come
back by being invited or signing up again. If your app still has records that belong to them —
orders they placed, notes they wrote — the account can't be deleted without losing those, so it is
refused and you are asked to suspend them instead. The history of what was done to them stays.

## What Sapilon logs

Every change is recorded in the app's own history. Looking at the people of the **Live Server** is
logged in your project's data-access log, the same as reading its database.