Teams and access
Organizations and departments, roles and areas, approvals, invitations, and the audit log.
An organization is a team's account. The Team page is where its owners run it: who is in it, what each person may do, where they may do it, and whether their changes wait for an owner first.
Roles
| Viewer | Reads everything: apps, logs, settings (never sealed values), databases, the team. |
|---|---|
| Member | Also deploys, restarts and runs commands. |
| Admin | Also creates and reconfigures apps, databases, domains, clusters and API tokens, and invites people. |
| Owner | Also manages people, billing and servers, decides who is trusted, and can close the organization. |
A role can be raised on one project only: give somebody viewer across the organization and member on the one project they work on.
Trust and approvals
An owner's changes, and a trusted person's, happen straight away. Anybody else's change waits for an owner: it appears under Approvals, and nothing happens until an owner accepts it.
- Accepted, it is carried out exactly as asked, as the person who asked, with the role they have at that moment. If they were removed or demoted in the meantime, it fails instead.
- Rejected, nothing happens. Either way, both of you can see the decision and any note with it.
- The owner deciding never sees a secret: values, tokens and passwords in a waiting change are masked. A new API token's secret goes only to the person who asked for it, once.
- Reading anything never waits. A change nobody decides on expires after a week.
Somebody new starts out not trusted unless the owner who invites them says otherwise. An owner changes that on the Team page at any time.
Bringing people in
Under Invite someone on the Team page, choose the role and, for an admin, the areas below, and whether their changes wait for your approval. Then choose who the link is for:
- Only this email: only an account with that address can use it.
- Whoever opens it first: handy for somebody whose address you do not know, so send it only to the person you mean.
Press Make the link and send it however you like. A link works once, expires after the days you chose (1 to 30; 7 unless you say otherwise), can be revoked, and can be copied again later. Nobody is ever added to an organization without accepting, and inviting an address tells you nothing about whether it already has an account.
Areas
An admin can be limited to areas of the work, so somebody brought in "for the databases" can change databases and nothing else:
| Apps | Apps and projects, and everything that builds, runs or configures them. |
|---|---|
| Databases | Creating, attaching and deleting databases. |
| Clusters | Clusters and servers. |
| VPN | VPN devices. |
| API tokens | Making and revoking tokens. |
Outside their areas an admin's change is refused, not held for approval. Changes to the organization as a whole (its name, notification channels and similar) are only for people without areas. An admin can invite others only into their own areas, at most at their own role, never as owner and never trusted, and they see and manage only the people they brought in.
Departments
A large organization can have departments, such as POS, HR and Sales, each with its own apps, databases and people. Create one under Departments on the Team page. A department:
- is owned by the main organization's owners, and nobody else;
- shares the main organization's plan: the plan's limits hold for all of them together, and its usage is on the main organization's bill;
- can be capped below the plan by an owner (apps, CPU, memory).
Switch into a department at the top of the menu. The main organization's owners see, under Who has access to what, every person across every department: their role and areas in each, who gave them access, the tokens and VPN devices they hold, what of theirs is waiting, when they were last active, and what they have done.
The audit log
Every change is recorded with who made it and when: deployments, settings, invitations, approvals, openings of the Develop section, everything. Owners read all of it; an admin reads what they and the people they invited did. Secret values are never recorded, only that they changed.
Notifications
Under Notifications, add where your team wants to be told when something needs attention:
- a webhook that receives the notification as JSON, for anything of your own;
- Slack, or Discord at the same kind of address;
- a Telegram chat, through your bot;
You are told when a deploy fails, when an app becomes unhealthy, when the organization nears or reaches a limit of its plan, and when a change is waiting for an owner.
API tokens and VPN devices
An API token is how a script or the command-line tool acts for you. It acts as you: never above your role, and if your changes wait for an owner, so do its changes. Make one under API tokens; its secret is shown once.
A VPN device is a laptop or phone that can reach your organization's private apps. Add one under VPN devices and import the WireGuard configuration you are given, which is shown once. Removing a device cuts it off within seconds.
Both belong to the person who made them. Removing somebody from the organization revokes their tokens, cuts their devices off the VPN, withdraws everything of theirs that was waiting, and takes them out of the Develop section.
Next: Security