Self-registration and approving new members

When someone in your company signs in to StackJack through an AI tool without having been invited first, they are not blocked — they are added to your team automatically in a pending approval state. Their AI tool connects, but with almost nothing enabled, until an admin approves them. This page explains both sides: what the new user experiences, and exactly how an admin approves (or denies) them.

How self-registration happens

A user whose identity belongs to your organization signs in through an AI tool's "Sign in with StackJack" flow. If they have no invite and no existing membership, StackJack:

• Creates a team membership for them with the Member role, active immediately.
• Grants them only a placeholder status tool — no connector tools, no support tools.
• Lets the AI tool finish connecting normally.

The result: the connection works, but it is a waiting room, not access.

What the pending user sees

In their AI tool: the connection succeeds, but only a small set of read-only StackJack status tools is available (stackjack_session_info, stackjack_list_tools, stackjack_health_check, service status, advisories, release notes, tool guidance, and tool-list refresh). No connector tools appear. Asking the assistant to run stackjack_session_info returns a status of pending_approval with a message telling them to have their administrator go to the portal's Team page and assign them permissions.

In the portal: every page shows an Awaiting Approval notice (support code SJ-ACCESS-AWAITING-APPROVAL): "Your identity is recognized, but your administrator still needs to approve your Portal access." It includes the workspace name, their signed-in email, and a pre-filled support email link.

Tip for pending users: either of these is the fastest way to confirm you are in the pending state rather than misconfigured — run stackjack_session_info from your AI tool, or sign in to the portal and look for the Awaiting Approval panel.

How to approve a pending member (admins)

Who can approve: the account owner, co-owners, and Administrators.

The important thing to know up front: there is no "Approve" button. The AI tool's message says "accept you to the team" and the portal panel says "approve your account," but the actual approval action is assigning tools with Edit Tools:

1. Open the Team page (/team).
2. Look in the Active Members list — the self-registered person appears there as an ordinary row: Member role badge, green Active dot, and a tool label of "1 tools". That "1 tools" label is your only visual cue that they are pending. (They will not appear under Pending Invites — they were never invited — and the card's description about "accepted their invite" does not quite fit self-registered rows.)
3. Select Edit Tools on their row.
4. The dialog opens looking empty — that is expected. Their one placeholder status tool is not part of the selectable catalog, so nothing appears ticked and the button initially reads "Save (1 tools)". Both are cosmetic.
5. Select the tools to grant — use the quick-select presets (All Tools, My Plan, All <connector> per connector, Read Only, Write), the per-category "Select all" links, or tick tools individually — then Save.

When approval takes effect

• Their AI tool: on its very next request. Tool permissions are re-read on every call — no re-login, no reconnect, no token refresh needed. Tell them to just ask their assistant to try again (or refresh the tool list).
• The portal: on their next page load or sign-in, when Awaiting Approval flips to full access.

Roles and approval

Approval does not change their role — they stay a Member. Promoting them (Make Administrator, Make Co-owner) is a separate, owner-only action on the same row. Note that Make Co-owner counts as an implicit approval: co-owners always have all tools.

Pitfalls to avoid

• Saving without selecting anything keeps them pending. No tools granted means not approved.
• "Clear" then Save does not approve them either — it moves them to a different blocked state ("No tools assigned", support code SJ-ACCESS-NO-TOOLS).
• Do not re-invite them instead of using Edit Tools. Sending a fresh invite from the Team page technically works, but the invite's permissions only apply at the person's next sign-in — until then they stay pending, and the invite sits unaccepted in Pending Invites. Edit Tools is immediate; use it.

Denying a self-registered member

If the person should not have access at all, select Revoke Access on their row and confirm. This deactivates the membership and cuts off everything in one step — their AI tool connections, any personal credentials, and portal access. If they try to sign in again they are told access was revoked and to ask an admin for a new invite. See OIDC sessions and revoking AI access for the full effect.