DOCS / CONCEPTS / TEAM

Team

An operator account can include human team members. Each member has a role and can have an allow-list of service connections. Members sign in by email or through the account's SSO provider.

Roles

readonly - read-level access where a route uses the role gate
standard - the default role for ordinary operator work
admin - access to operator-admin routes such as team management, OAuth app management, and CMEK

See /docs/api/team for the full role × endpoint matrix.

An invitation link activates the member and signs them into the Console.
Members can return through the normal email sign-in form or the account SSO provider.
Human members do not receive API keys.
Revoking a member ends their access and revokes that member's OAuth refresh families.

Allowed connections

Each member can carry an allowed_connections array of service connection IDs. A non-empty list limits credential retrieval and proxy calls to those connections. A null or empty list grants access to every connection.

json

{
  "id":     "mem_b2…",
  "email":  "alice@acme.dev",
  "role":   "standard",
  "allowed_connections": ["scon_slack_prod", "scon_github_ops"],
  "status": "active"
}

Invite flow

1. An admin creates a member with POST /v1/team/members.
2. STACK emails a single-use link that expires after seven days.
3. Opening the link activates the member, signs them in, and opens the Console.
4. Later visits use the normal email sign-in form or SSO.

The invite token is stored as a hash, submitted once, and removed when the member joins.

Automatic cascades

Revocation disables the member identity and its live OAuth refresh families.
Members are revoked rather than deleted so their prior audit attribution remains.
Passport authority has its own revocation controls. Member revocation does not replace them.