> ## Documentation Index
> Fetch the complete documentation index at: https://docs.2501.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Users & Organizations

> Set up the initial tenant and administrator, then manage users and organizations in Command Center

## First deployment

The installer creates three files in the installation directory, `/etc/2501` by default. Edit them before the first deployment:

| File | What it defines |
| - | - |
| `tenant.yaml` | Optional tenant ID, initial name, timezone, and default models |
| `organization.yaml` | Initial organization names |
| `admin-user.yaml` | Initial administrator email and password |

If 2501 issued your license before the first deployment, set `tenant.id` in `tenant.yaml` to the tenant ID supplied with that license. The license is bound to that ID; without it, the engine generates a different ID when creating the tenant.

For example:

```yaml tenant.yaml theme={null}
tenant:
  name: My Company
  timezone: Europe/Paris
```

```yaml organization.yaml theme={null}
organizations:
  - Engineering
```

```yaml admin-user.yaml theme={null}
admin:
  email: admin@company.com
  password: ""
```

Run `2501 infra deploy`. The engine reads these files at boot and creates the initial tenant, organizations, and administrator. If the admin password is blank, the engine generates one and prints the login credentials to its logs. Retrieve them with `2501 infra logs engine`.

The CLI mounts `tenant.yaml`, `organization.yaml`, and `admin-user.yaml` into the engine as `tenant.yml`, `organizations.yml`, and `admin-user.yml` under `/etc/2501/identity`. Keep the installation filenames shown above.

For Kubernetes, deploy generates manifests for you to apply. The identity files are included in the generated ConfigMap and Secret; configure them before generating and applying the manifests.

Once a tenant, organization, and user exist, this setup is skipped on subsequent boots. Editing the files afterward does not update existing accounts or organizations.

## Ongoing management

Sign in to Command Center with the administrator account. Manage [users](/0.18/configure/users) and [organizations](/0.18/core-concepts/organizations) there. Tenant model defaults are editable under **Settings > Tenant**.

## User roles

| Role | Description |
| - | - |
| `ADMIN` | Full access to all resources and user management |
| `USER` | Read and write on org resources, read-only on shared resources |
| `AUDITOR` | Read-only access everywhere |

[Users](/0.18/configure/users)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.