[{"data":1,"prerenderedAt":758},["ShallowReactive",2],{"doc-features\u002Fteams-rbac":3,"content-query-nDxmB0xWdK":4},null,{"_path":5,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":9,"description":8,"sidebar_position":10,"body":11,"_type":752,"_id":753,"_source":754,"_file":755,"_stem":756,"_extension":757},"\u002Fdocs\u002Ffeatures\u002Fteams-rbac","features",false,"","RBAC & Team Management",5,{"type":12,"children":13,"toc":741},"root",[14,22,39,45,65,73,80,85,158,168,174,179,204,210,351,357,362,417,422,428,433,438,477,482,488,493,498,537,543,548,603,608,651,656,662,667,701,707,735],{"type":15,"tag":16,"props":17,"children":19},"element","h1",{"id":18},"rbac-team-management",[20],{"type":21,"value":9},"text",{"type":15,"tag":23,"props":24,"children":29},"div",{"className":25,"ariaHidden":28},[26,27],"docs-page-hero","docs-page-hero--sage","true",[30,32],{"type":21,"value":31},"\n  ",{"type":15,"tag":33,"props":34,"children":38},"img",{"src":35,"alt":8,"width":36,"height":37},"\u002Fimages\u002Fdocs-illustrations\u002Fteams.svg",128,72,[],{"type":15,"tag":40,"props":41,"children":42},"p",{},[43],{"type":21,"value":44},"RBAC controls who can see, create, modify, and delete resources in CredVault — across the dashboard, admin portal, and Pragma enterprise areas.",{"type":15,"tag":40,"props":46,"children":47},{},[48,54,56,63],{"type":15,"tag":49,"props":50,"children":51},"strong",{},[52],{"type":21,"value":53},"Team Management",{"type":21,"value":55}," in the sidebar (",{"type":15,"tag":57,"props":58,"children":60},"code",{"className":59},[],[61],{"type":21,"value":62},"\u002Fteam",{"type":21,"value":64},") is CredVault’s in-product directory and access UI. Open it after sign-in; this page documents roles and where access shows up, not a separate vendor manual.",{"type":15,"tag":40,"props":66,"children":67},{},[68],{"type":15,"tag":33,"props":69,"children":72},{"alt":70,"src":71},"Team access administration","\u002Fimages\u002Fplatform-docs\u002Fteam-access-admin.jpg",[],{"type":15,"tag":74,"props":75,"children":77},"h2",{"id":76},"user-facing-areas",[78],{"type":21,"value":79},"User-Facing Areas",{"type":15,"tag":40,"props":81,"children":82},{},[83],{"type":21,"value":84},"Users encounter team and role controls in:",{"type":15,"tag":86,"props":87,"children":90},"pre",{"className":88,"code":89,"language":21,"meta":8,"style":8},"language-text shiki shiki-themes github-dark","\u002Fsettings\n\u002Fteam\n\u002Fapi-keys\n\u002Flogs\n\u002Fbilling\n\u002Fpragma-enterprise\nadmin portal user management\n",[91],{"type":15,"tag":57,"props":92,"children":93},{"__ignoreMap":8},[94,105,114,123,132,140,149],{"type":15,"tag":95,"props":96,"children":99},"span",{"class":97,"line":98},"line",1,[100],{"type":15,"tag":95,"props":101,"children":102},{},[103],{"type":21,"value":104},"\u002Fsettings\n",{"type":15,"tag":95,"props":106,"children":108},{"class":97,"line":107},2,[109],{"type":15,"tag":95,"props":110,"children":111},{},[112],{"type":21,"value":113},"\u002Fteam\n",{"type":15,"tag":95,"props":115,"children":117},{"class":97,"line":116},3,[118],{"type":15,"tag":95,"props":119,"children":120},{},[121],{"type":21,"value":122},"\u002Fapi-keys\n",{"type":15,"tag":95,"props":124,"children":126},{"class":97,"line":125},4,[127],{"type":15,"tag":95,"props":128,"children":129},{},[130],{"type":21,"value":131},"\u002Flogs\n",{"type":15,"tag":95,"props":133,"children":134},{"class":97,"line":10},[135],{"type":15,"tag":95,"props":136,"children":137},{},[138],{"type":21,"value":139},"\u002Fbilling\n",{"type":15,"tag":95,"props":141,"children":143},{"class":97,"line":142},6,[144],{"type":15,"tag":95,"props":145,"children":146},{},[147],{"type":21,"value":148},"\u002Fpragma-enterprise\n",{"type":15,"tag":95,"props":150,"children":152},{"class":97,"line":151},7,[153],{"type":15,"tag":95,"props":154,"children":155},{},[156],{"type":21,"value":157},"admin portal user management\n",{"type":15,"tag":40,"props":159,"children":160},{},[161,166],{"type":15,"tag":57,"props":162,"children":164},{"className":163},[],[165],{"type":21,"value":62},{"type":21,"value":167}," is the primary place to manage users, groups, and directory settings for the workspace.",{"type":15,"tag":74,"props":169,"children":171},{"id":170},"core-model",[172],{"type":21,"value":173},"Core Model",{"type":15,"tag":40,"props":175,"children":176},{},[177],{"type":21,"value":178},"CredVault access is tenant-based:",{"type":15,"tag":180,"props":181,"children":182},"ol",{},[183,189,194,199],{"type":15,"tag":184,"props":185,"children":186},"li",{},[187],{"type":21,"value":188},"A user belongs to a tenant or workspace.",{"type":15,"tag":184,"props":190,"children":191},{},[192],{"type":21,"value":193},"The tenant owns clusters, API keys, functions, webhooks, billing, and logs.",{"type":15,"tag":184,"props":195,"children":196},{},[197],{"type":21,"value":198},"A role determines what the user can do inside that tenant.",{"type":15,"tag":184,"props":200,"children":201},{},[202],{"type":21,"value":203},"Sensitive routes validate both authentication and tenant\u002Fresource access.",{"type":15,"tag":74,"props":205,"children":207},{"id":206},"common-roles",[208],{"type":21,"value":209},"Common Roles",{"type":15,"tag":211,"props":212,"children":213},"table",{},[214,238],{"type":15,"tag":215,"props":216,"children":217},"thead",{},[218],{"type":15,"tag":219,"props":220,"children":221},"tr",{},[222,228,233],{"type":15,"tag":223,"props":224,"children":225},"th",{},[226],{"type":21,"value":227},"Role",{"type":15,"tag":223,"props":229,"children":230},{},[231],{"type":21,"value":232},"Typical access",{"type":15,"tag":223,"props":234,"children":235},{},[236],{"type":21,"value":237},"Best for",{"type":15,"tag":239,"props":240,"children":241},"tbody",{},[242,261,279,297,315,333],{"type":15,"tag":219,"props":243,"children":244},{},[245,251,256],{"type":15,"tag":246,"props":247,"children":248},"td",{},[249],{"type":21,"value":250},"Owner",{"type":15,"tag":246,"props":252,"children":253},{},[254],{"type":21,"value":255},"Billing, users, clusters, API keys, settings, destructive actions",{"type":15,"tag":246,"props":257,"children":258},{},[259],{"type":21,"value":260},"Founder, CTO, platform owner",{"type":15,"tag":219,"props":262,"children":263},{},[264,269,274],{"type":15,"tag":246,"props":265,"children":266},{},[267],{"type":21,"value":268},"Admin",{"type":15,"tag":246,"props":270,"children":271},{},[272],{"type":21,"value":273},"Operational management except highest billing\u002Forg controls",{"type":15,"tag":246,"props":275,"children":276},{},[277],{"type":21,"value":278},"Engineering manager, platform admin",{"type":15,"tag":219,"props":280,"children":281},{},[282,287,292],{"type":15,"tag":246,"props":283,"children":284},{},[285],{"type":21,"value":286},"Developer",{"type":15,"tag":246,"props":288,"children":289},{},[290],{"type":21,"value":291},"Clusters, data, functions, webhooks, logs needed for development",{"type":15,"tag":246,"props":293,"children":294},{},[295],{"type":21,"value":296},"Engineers",{"type":15,"tag":219,"props":298,"children":299},{},[300,305,310],{"type":15,"tag":246,"props":301,"children":302},{},[303],{"type":21,"value":304},"Viewer",{"type":15,"tag":246,"props":306,"children":307},{},[308],{"type":21,"value":309},"Read-only dashboards, logs, metrics, docs",{"type":15,"tag":246,"props":311,"children":312},{},[313],{"type":21,"value":314},"Analysts, auditors",{"type":15,"tag":219,"props":316,"children":317},{},[318,323,328],{"type":15,"tag":246,"props":319,"children":320},{},[321],{"type":21,"value":322},"App Builder",{"type":15,"tag":246,"props":324,"children":325},{},[326],{"type":21,"value":327},"Limited technical task surface for building installers or assigned app tasks",{"type":15,"tag":246,"props":329,"children":330},{},[331],{"type":21,"value":332},"External builders, contractors",{"type":15,"tag":219,"props":334,"children":335},{},[336,341,346],{"type":15,"tag":246,"props":337,"children":338},{},[339],{"type":21,"value":340},"Super Admin",{"type":15,"tag":246,"props":342,"children":343},{},[344],{"type":21,"value":345},"Internal platform-wide administration",{"type":15,"tag":246,"props":347,"children":348},{},[349],{"type":21,"value":350},"CredVault internal operators",{"type":15,"tag":74,"props":352,"children":354},{"id":353},"how-permissions-are-enforced",[355],{"type":21,"value":356},"How Permissions Are Enforced",{"type":15,"tag":40,"props":358,"children":359},{},[360],{"type":21,"value":361},"The backend uses middleware before sensitive routes. Examples:",{"type":15,"tag":86,"props":363,"children":365},{"className":88,"code":364,"language":21,"meta":8,"style":8},"authenticateToken\nensureTenantAccess\nensureClusterAccess\nenforceClusterIPWhitelist\nenforceAPIKeyIPWhitelist\ncheckAdminRoleJWT\n",[366],{"type":15,"tag":57,"props":367,"children":368},{"__ignoreMap":8},[369,377,385,393,401,409],{"type":15,"tag":95,"props":370,"children":371},{"class":97,"line":98},[372],{"type":15,"tag":95,"props":373,"children":374},{},[375],{"type":21,"value":376},"authenticateToken\n",{"type":15,"tag":95,"props":378,"children":379},{"class":97,"line":107},[380],{"type":15,"tag":95,"props":381,"children":382},{},[383],{"type":21,"value":384},"ensureTenantAccess\n",{"type":15,"tag":95,"props":386,"children":387},{"class":97,"line":116},[388],{"type":15,"tag":95,"props":389,"children":390},{},[391],{"type":21,"value":392},"ensureClusterAccess\n",{"type":15,"tag":95,"props":394,"children":395},{"class":97,"line":125},[396],{"type":15,"tag":95,"props":397,"children":398},{},[399],{"type":21,"value":400},"enforceClusterIPWhitelist\n",{"type":15,"tag":95,"props":402,"children":403},{"class":97,"line":10},[404],{"type":15,"tag":95,"props":405,"children":406},{},[407],{"type":21,"value":408},"enforceAPIKeyIPWhitelist\n",{"type":15,"tag":95,"props":410,"children":411},{"class":97,"line":142},[412],{"type":15,"tag":95,"props":413,"children":414},{},[415],{"type":21,"value":416},"checkAdminRoleJWT\n",{"type":15,"tag":40,"props":418,"children":419},{},[420],{"type":21,"value":421},"This means a signed-in user still cannot access every resource. The user must also belong to the correct tenant or have the correct admin role.",{"type":15,"tag":74,"props":423,"children":425},{"id":424},"api-key-permissions",[426],{"type":21,"value":427},"API Key Permissions",{"type":15,"tag":40,"props":429,"children":430},{},[431],{"type":21,"value":432},"API keys use scopes. Scopes should be narrower than user roles.",{"type":15,"tag":40,"props":434,"children":435},{},[436],{"type":21,"value":437},"Example:",{"type":15,"tag":86,"props":439,"children":441},{"className":88,"code":440,"language":21,"meta":8,"style":8},"data:read\ndata:write\nwebhooks:manage\nfunctions:execute\n",[442],{"type":15,"tag":57,"props":443,"children":444},{"__ignoreMap":8},[445,453,461,469],{"type":15,"tag":95,"props":446,"children":447},{"class":97,"line":98},[448],{"type":15,"tag":95,"props":449,"children":450},{},[451],{"type":21,"value":452},"data:read\n",{"type":15,"tag":95,"props":454,"children":455},{"class":97,"line":107},[456],{"type":15,"tag":95,"props":457,"children":458},{},[459],{"type":21,"value":460},"data:write\n",{"type":15,"tag":95,"props":462,"children":463},{"class":97,"line":116},[464],{"type":15,"tag":95,"props":465,"children":466},{},[467],{"type":21,"value":468},"webhooks:manage\n",{"type":15,"tag":95,"props":470,"children":471},{"class":97,"line":125},[472],{"type":15,"tag":95,"props":473,"children":474},{},[475],{"type":21,"value":476},"functions:execute\n",{"type":15,"tag":40,"props":478,"children":479},{},[480],{"type":21,"value":481},"Use API keys for applications. Use user sessions for dashboard actions.",{"type":15,"tag":74,"props":483,"children":485},{"id":484},"app-builder-role",[486],{"type":21,"value":487},"App Builder Role",{"type":15,"tag":40,"props":489,"children":490},{},[491],{"type":21,"value":492},"Use the App Builder role for outside people who should not be admins. They should see only the task instructions and account controls needed to complete assigned build work.",{"type":15,"tag":40,"props":494,"children":495},{},[496],{"type":21,"value":497},"Recommended access:",{"type":15,"tag":499,"props":500,"children":501},"ul",{},[502,507,512,517,522,527,532],{"type":15,"tag":184,"props":503,"children":504},{},[505],{"type":21,"value":506},"View assigned build task",{"type":15,"tag":184,"props":508,"children":509},{},[510],{"type":21,"value":511},"View OS-specific build instructions",{"type":15,"tag":184,"props":513,"children":514},{},[515],{"type":21,"value":516},"Run the approved build workflow",{"type":15,"tag":184,"props":518,"children":519},{},[520],{"type":21,"value":521},"Automatic upload\u002Fsync of finished artifacts",{"type":15,"tag":184,"props":523,"children":524},{},[525],{"type":21,"value":526},"View own account profile",{"type":15,"tag":184,"props":528,"children":529},{},[530],{"type":21,"value":531},"Edit display name and avatar\u002Fmemoji",{"type":15,"tag":184,"props":533,"children":534},{},[535],{"type":21,"value":536},"No billing, no admin users, no global settings",{"type":15,"tag":74,"props":538,"children":540},{"id":539},"test-it",[541],{"type":21,"value":542},"Test It",{"type":15,"tag":40,"props":544,"children":545},{},[546],{"type":21,"value":547},"Browser checks:",{"type":15,"tag":86,"props":549,"children":551},{"className":88,"code":550,"language":21,"meta":8,"style":8},"1. Sign in as an admin\n2. Open admin user management\n3. Assign a test user a limited role\n4. Sign in as that user\n5. Confirm restricted pages are hidden or blocked\n6. Open \u002Flogs and confirm role\u002Fuser changes are audited\n",[552],{"type":15,"tag":57,"props":553,"children":554},{"__ignoreMap":8},[555,563,571,579,587,595],{"type":15,"tag":95,"props":556,"children":557},{"class":97,"line":98},[558],{"type":15,"tag":95,"props":559,"children":560},{},[561],{"type":21,"value":562},"1. Sign in as an admin\n",{"type":15,"tag":95,"props":564,"children":565},{"class":97,"line":107},[566],{"type":15,"tag":95,"props":567,"children":568},{},[569],{"type":21,"value":570},"2. Open admin user management\n",{"type":15,"tag":95,"props":572,"children":573},{"class":97,"line":116},[574],{"type":15,"tag":95,"props":575,"children":576},{},[577],{"type":21,"value":578},"3. Assign a test user a limited role\n",{"type":15,"tag":95,"props":580,"children":581},{"class":97,"line":125},[582],{"type":15,"tag":95,"props":583,"children":584},{},[585],{"type":21,"value":586},"4. Sign in as that user\n",{"type":15,"tag":95,"props":588,"children":589},{"class":97,"line":10},[590],{"type":15,"tag":95,"props":591,"children":592},{},[593],{"type":21,"value":594},"5. Confirm restricted pages are hidden or blocked\n",{"type":15,"tag":95,"props":596,"children":597},{"class":97,"line":142},[598],{"type":15,"tag":95,"props":599,"children":600},{},[601],{"type":21,"value":602},"6. Open \u002Flogs and confirm role\u002Fuser changes are audited\n",{"type":15,"tag":40,"props":604,"children":605},{},[606],{"type":21,"value":607},"API checks:",{"type":15,"tag":86,"props":609,"children":613},{"className":610,"code":611,"language":612,"meta":8,"style":8},"language-bash shiki shiki-themes github-dark","curl https:\u002F\u002Fcredvault.net\u002Fapi\u002Fauth\u002Fprofile \\\n  -H \"Authorization: Bearer \u003Cuser-token>\"\n","bash",[614],{"type":15,"tag":57,"props":615,"children":616},{"__ignoreMap":8},[617,638],{"type":15,"tag":95,"props":618,"children":619},{"class":97,"line":98},[620,626,632],{"type":15,"tag":95,"props":621,"children":623},{"style":622},"--shiki-default:#B392F0",[624],{"type":21,"value":625},"curl",{"type":15,"tag":95,"props":627,"children":629},{"style":628},"--shiki-default:#9ECBFF",[630],{"type":21,"value":631}," https:\u002F\u002Fcredvault.net\u002Fapi\u002Fauth\u002Fprofile",{"type":15,"tag":95,"props":633,"children":635},{"style":634},"--shiki-default:#79B8FF",[636],{"type":21,"value":637}," \\\n",{"type":15,"tag":95,"props":639,"children":640},{"class":97,"line":107},[641,646],{"type":15,"tag":95,"props":642,"children":643},{"style":634},[644],{"type":21,"value":645},"  -H",{"type":15,"tag":95,"props":647,"children":648},{"style":628},[649],{"type":21,"value":650}," \"Authorization: Bearer \u003Cuser-token>\"\n",{"type":15,"tag":40,"props":652,"children":653},{},[654],{"type":21,"value":655},"Then try a protected resource the user should not access. It should return a permission error.",{"type":15,"tag":74,"props":657,"children":659},{"id":658},"documentation-gaps-to-watch",[660],{"type":21,"value":661},"Documentation Gaps To Watch",{"type":15,"tag":40,"props":663,"children":664},{},[665],{"type":21,"value":666},"If you add a new role, update:",{"type":15,"tag":499,"props":668,"children":669},{},[670,675,680,685,696],{"type":15,"tag":184,"props":671,"children":672},{},[673],{"type":21,"value":674},"Admin portal role creation UI",{"type":15,"tag":184,"props":676,"children":677},{},[678],{"type":21,"value":679},"Backend role constants and authorization checks",{"type":15,"tag":184,"props":681,"children":682},{},[683],{"type":21,"value":684},"Sidebar\u002Fpage visibility rules",{"type":15,"tag":184,"props":686,"children":687},{},[688,694],{"type":15,"tag":57,"props":689,"children":691},{"className":690},[],[692],{"type":21,"value":693},"\u002Flogs",{"type":21,"value":695}," event names",{"type":15,"tag":184,"props":697,"children":698},{},[699],{"type":21,"value":700},"This documentation page",{"type":15,"tag":74,"props":702,"children":704},{"id":703},"best-practices",[705],{"type":21,"value":706},"Best Practices",{"type":15,"tag":499,"props":708,"children":709},{},[710,715,720,725,730],{"type":15,"tag":184,"props":711,"children":712},{},[713],{"type":21,"value":714},"Give contractors the smallest role that lets them finish the task.",{"type":15,"tag":184,"props":716,"children":717},{},[718],{"type":21,"value":719},"Do not make App Builders admins.",{"type":15,"tag":184,"props":721,"children":722},{},[723],{"type":21,"value":724},"Keep billing access separate from technical build access.",{"type":15,"tag":184,"props":726,"children":727},{},[728],{"type":21,"value":729},"Use logs to audit role changes.",{"type":15,"tag":184,"props":731,"children":732},{},[733],{"type":21,"value":734},"Test every new role with a real non-admin account.",{"type":15,"tag":736,"props":737,"children":738},"style",{},[739],{"type":21,"value":740},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":8,"searchDepth":107,"depth":107,"links":742},[743,744,745,746,747,748,749,750,751],{"id":76,"depth":107,"text":79},{"id":170,"depth":107,"text":173},{"id":206,"depth":107,"text":209},{"id":353,"depth":107,"text":356},{"id":424,"depth":107,"text":427},{"id":484,"depth":107,"text":487},{"id":539,"depth":107,"text":542},{"id":658,"depth":107,"text":661},{"id":703,"depth":107,"text":706},"markdown","content:docs:features:teams-rbac.md","content","docs\u002Ffeatures\u002Fteams-rbac.md","docs\u002Ffeatures\u002Fteams-rbac","md",1794695980438]