---
title: "Never let admins choose or see a member's · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/organisations-and-teams/admin-set-passwords
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Never let admins choose or see a member's password

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

For AI agents: [llms.txt](https://agentwranglers.se/llms.txt) is a short guide that sends you to the rules your problem needs, and [rules.json](https://agentwranglers.se/playbook/accounts/rules.json) holds every rule of this playbook as JSON.

- Level: Recommended
- Chapter: [Organisations and teams](https://agentwranglers.se/playbook/accounts/organisations-and-teams)
- Rule: When an admin adds a member or resets their sign-in, send the member a setup link. The admin never types, sees or receives a password.
- Applies when: The project it has user accounts.
- How: NIST SP 800-63B-4 says a password is chosen by the person or assigned at random by the service. A password an admin typed is known to two people, and it often travels by chat or email. Give the "add member" form an email field and a role, then send an [invitation](https://agentwranglers.se/playbook/accounts/organisations-and-teams/invitations). Let a "reset sign-in" button send the member a reset as [make password resets safe](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/password-reset) builds it. Leave the old password working until the member sets a new one. Write an [audit event](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-events) for each reset an admin starts.
- Check: The add-member and edit-member forms have no password field. Call the admin reset endpoint for a test member. The response holds no password or link, and the member's inbox gets the reset email.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
app.post('/org/:orgId/members/:userId/reset-sign-in', requirePermission('members.manage'), async (req, res) => {
  const member = await members.find(req.params.orgId, req.params.userId);
  if (!member) return res.sendStatus(404);
  await passwordResets.sendTo(member.userId);
  await audit.append({ organisationId: req.params.orgId, actor: req.user.id, type: 'member.reset_started', subject: member.userId });
  res.sendStatus(202);
});
```

### Python example

```python
@app.post("/org/<org_id>/members/<user_id>/reset-sign-in")
@require_permission("members.manage")
def reset_member_sign_in(org_id: str, user_id: str):
    member = members.find(org_id, user_id)
    if member is None:
        abort(404)
    password_resets.send_to(member.user_id)
    audit.append(organisation_id=org_id, actor=current_user.id, type="member.reset_started", subject=member.user_id)
    return "", 202
```

## Sources

- [NIST SP 800-63B-4 on password authenticators](https://pages.nist.gov/800-63-4/sp800-63b.html#password-authenticators)

## Related rules

- [Make invitations expire and work once](https://agentwranglers.se/playbook/accounts/organisations-and-teams/invitations) in Accounts
- [Make password resets safe](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/password-reset) in Security testing
- [Write an audit event for every sensitive action](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-events) in Compliance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/accounts/organisations-and-teams/admin-set-passwords">Agent Wranglers accounts playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Keep the organisation in the address](https://agentwranglers.se/playbook/accounts/organisations-and-teams/organisation-in-url)
- [Organisations and teams](https://agentwranglers.se/playbook/accounts/organisations-and-teams)