Admins invite by email from Settings → Members. Invitations use tokens accepted at /organization/accept-invite?token=....
Invites can specify workspace-level roles for the member on accept. For large teams, prefer SCIM / directory sync (Clerk Directory Sync) with group role mappings and provisioning rules instead of manual invites.