Users, Teams & RBAC

Users & Teams

Admin → Users and teams manages the member directory:

• Users — everyone in the organization, with status. Edit or remove via the row actions.
• Teams — create teams and manage membership.
• Invitations — click Invite User, enter an email; the invitee receives a link (/invitations/accept/<token>) and joins the organization on first login.

RBAC

Admin → RBAC assigns roles to principals — users, teams, or service accounts:

1. Click Grant access.
2. Pick the principal (user email, team, or service account).
3. Pick the role and scope:
   • ORG roles (e.g. Organization Owner, Organization Member) apply everywhere.
   • TENANT roles (e.g. Team Owner) apply within one tenant.

Key things to know:

• Service accounts start with zero permissions. An Ocean exporter or CI integration will get 403s until you grant its service account a role here (the demo grants ocean-ingest Organization Owner).
• Changes take up to ~5 minutes — permission denials are cached.
• A principal can hold multiple roles; permissions are additive.
• Users can check their own effective permissions under Profile → My Permissions.

Service accounts

Admin → Credentials manages machine identities:

• Create Service Account → name + description → you get a Client ID (pa_...) and a Client Secret (shown once).
• Machines exchange these for a token via POST /v1/auth/access_token (see API reference).
• Last used shows whether an integration is actually authenticating.
• Delete an account to revoke access immediately.