Owners, teams and scope
Share work with exactly the right people, and keep it running when people change roles or leave. Marshal answers “who can do this?” with two ideas. A role says what a person can do in the organization. An owner scope says who owns an object: one person, a team, or the whole organization.
What you can do with it
- A team that owns its tools. The Platform team owns the
backend-devmanifest, the team’s GitHub credential and a “Bump dependencies” deputy. Every team member launches them. Only the team’s leads and admins change them. - Hand over before someone leaves. Dana owns the personal
ci-bottoken. Before she leaves, move it to the Platform team with Change owner. You can move an object when you can manage both the old owner and the new one. - Share without giving away control. Share your Sentry API key with the Platform team for use. The team binds it in its manifests, but nobody on the team sees the value, changes it or shares it on.
See it end to end: A governed dev environment for every engineer.
How it fits
- Roles. Each member has one role per organization: Owner (full control, including roles and deleting the organization), Admin (runs the organization day to day: members, teams, packages, policies and organization-wide objects), or Member (creates their own things and uses what is shared with them).
- Teams. Admins create teams and choose who is in them. A person can be in many teams. Inside a team, each person is a member or a lead. A lead manages the team’s roster and everything the team owns. Admins and owners have lead rights over every team.
- Owner scope. Manifests, stacks, credentials, HTTP secrets and deputies each have an owner. A space always belongs to one person.
| Scope | Owner | Who uses it | Who manages it |
|---|---|---|---|
| Personal | One person | That person | That person |
| Team | A team | The team’s members | The team’s leads, admins and owners |
| Organization | Everyone | Everyone in the organization | Admins and owners |
How access is checked
Every object answers four questions:
- See. Can I know it exists?
- Use. Can I launch it or bind it?
- Manage. Can I change it?
- Share. Can I give others access?
A share gives see or use access, never manage. When you can see an object but not use it, you can read it but not launch it.
Behavior
- You choose the owner when you create an object that has one. Creating for a team needs a lead of that team or an admin. Creating for the organization needs an admin or owner.
- Lists in the web app show everything you can see, grouped by owner: yours, each of your teams, the organization, and other people’s.
- When a team is archived, the things it owns stay visible and become read-only until someone moves them. Its deputies are suspended.
- Removing someone from the organization removes them from every team.
- An organization always has at least one owner. Credential values are never readable by any role.
Related
- Roles and permissions: the full table, role by role.
- Create and manage a team and Change the owner of a resource.
- Invite a teammate and Remove a member.