Users & permissions
Access Control is where you invite people into your workspace and set what each one can do, from full control down to read-only. You invite someone by email; once they accept, their access level governs every action they can take on your instances, storage, and settings.
Open it from Security in the sidebar, then Access Control.
Invite someone
On the Access Control page, select Invite User. The dialog asks for two things: the person's email address and the access level you want them to have. You can only grant a level below your own.
When you create the invite, the panel emails a single-use invite code to that address. The same code is recorded on your Access Control page, in the Invite code column, so you can also pass it along yourself if the email does not arrive. The person redeems the code to join, and once they join they appear in the members table with their access level.
The access levels
There are three access levels you can grant when you invite or edit a member, from most power to least. Give people the lowest level that still lets them do their job.
| Access level | What they can do |
|---|---|
| Administrator | Manage resources and members. An administrator can create and change instances and other resources, and invite, edit, or remove members. |
| Editor | Create and change resources. An editor can build and modify instances and the things around them, but does not manage the workspace's members. |
| Viewer | Read only. A viewer can see the workspace and its resources but cannot change anything. |
The person who created the workspace is its Owner. Owner is a status, not a level you assign: it is not offered when you invite or edit a member, and the owner row cannot be edited or removed in the UI. The owner has full control of the workspace, including billing and deleting the workspace itself.
Least privilege
Start people at Viewer or Editor. You can raise someone's level later, and it is far easier than walking back access that was too broad.
Change a member's access level
Use the row action to edit a member. A dialog opens where you choose a new access level and press Save. The change takes effect immediately: a member you move from Editor to Viewer loses the ability to make changes right away.
Remove a member
Use the row action to remove a member. Their access ends immediately. To pause access rather than end it, lower their level to Viewer instead of removing them.
The owner cannot be changed here
The workspace owner is fixed. The panel does not let you edit or remove the owner row, so an owner cannot be downgraded or taken out of the workspace through the panel. This keeps someone in place who can always manage billing and workspace-level settings.
Related
- Security overview
- API tokens for giving scripts access instead of people.
- Audit Logs to see who changed what.