Docs / Workspace
Members and roles
Invite your team and decide who may plan, build, deploy, approve and manage.
Members sign in to your workspace’s own identity realm. What each member may do is set by their role, and every check happens on the server, on every request.
Members
- Add a member under Users with their name, email and role. They receive an invitation by email to set their password.
- Send the invitation again if it was missed.
- Deactivate a member to stop them signing in; reactivate them later if needed. Nothing they did is removed from the audit trail.
- To add many at once, see Import users.
Roles
A role is a named set of permissions. Create roles to match how your team works and archive them when they are no longer needed. An archived role grants nothing.
Permissions
| Area | Permissions |
|---|---|
| Clusters | cluster.read, cluster.manage, cluster.destroy |
| Environments | environment.read, environment.manage |
| Cloud accounts | cloud.read, cloud.connect |
| Plans | plan.read, plan.create, plan.approve, plan.approve_destructive |
| Repositories | repository.read, repository.manage |
| Applications | application.read, application.manage |
| Deployments | deployment.read, deployment.run, deployment.approve, deployment.rollback |
| Members | user.read, user.invite, user.manage |
| Roles | role.read, role.manage |
| Workspace | workspace.read, workspace.manage |
| Activity and insights | activity.read, cost.read |
cloud.connect also governs who may use the clusters in an account (see Cluster access for your team). cost.read opens the KPIs screen.