Organizations and permissions
Building blocks
| Object | What it is | Managed in the admin console |
|---|---|---|
| User | A person's account. Work, usage and data belong to the account, not the device | User management |
| Organization unit | A department in a tree. A unit without a parent is a root department | Organization |
| Role | A named set of permission keys. System roles can't be deleted | Roles and permissions |
| Project | A unit of work, optionally linked to a repository. Issues, chats and plugin bindings can be scoped to it | Projects and repos |
Sign-in options (email and password, email code, enterprise SSO) are set in Accounts & security and Identity access. Every admin action is recorded in the Audit log.
Permission keys
Roles combine these keys:
| Group | Keys |
|---|---|
| Organization and users | org.manage, user.manage, role.manage, identity.manage, work.catalog.manage |
| Clients and runners | client.view, client.assign, client.control, client.update, runner.manage |
| Platform | quota.manage, operations.view |
| Issues | task.view, task.dispatch, flow.manage |
| Delivery | delivery.review, delivery.merge, delivery.accept, delivery.deploy, environment.manage |
| Plugins | plugin.manage, plugin.run |
| Integrations | integration.manage, binding.manage |
| Audit | audit.view |
Who can see an issue
- A new issue is visible only to the people involved: its creator, owner and assignees.
- Explicit assignment, participant access, repository membership and manual team sharing follow their own rules.
- Team sharing lets people read the issue's content. It doesn't grant access to execution records, attachments or execution actions.
Accounts and devices
A device ID only tells the Hub which machine is running work. The Hub checks both the device and the account.
- When someone else signs in on a device, the earlier account's tasks are not moved to the new account.
- Attachments, generated media, usage records, live connections and client caches are all scoped to the account.
- Results, reminders and notifications carry the target account. A late event is never delivered to an account that signed in afterwards.
- Deleting an account is handled by the stable owner of each task, automation and runner, not by who is using a device now.
Plugins across the organization
A plugin published and bound by a parent organization can be used by its departments, within their permissions. Project limits, chosen audiences and isolation between companies still apply (Publish to your organization).