Team users, roles, and permissions

Account users administer your Cloudgate workspace. Give each person the permissions needed for their work, and manage application end users separately through the Identity Provider.

Add a team member#

Open Settings → Users and use the supported creation or invitation flow. Assign an appropriate role and confirm the person is entering the intended workspace.

Use Settings → Roles to review capabilities such as workflow editing, release approval, logging, databases, and account administration. A role's display name does not explain every permission it grants; inspect the permission settings before assigning it broadly.

Separate editing from release authority#

A person who can edit a workflow may not be allowed to approve or publish a release. Design roles around your review process and verify the resulting controls from that user's perspective.

If a screen or button is missing, check the relevant view and edit permissions, private controller/action visibility, and enabled account features before assuming the data has disappeared.

Secret-selector access#

Secret selectors have additional reveal and edit controls. Both Text (Secret) and Base64 (Secret) use protected secret access. Ordinary list views mask their values, and exports omit secret contents.

Grant secret access only when needed for configuration or diagnosis. Test with masked views where possible; most workflow debugging needs status and shape rather than the credential itself.

Protect your account session#

Use the account's security settings to configure available two-factor authentication and recovery options. Keep recovery information accessible to the account owner and review linked accounts when changing sign-in methods.

Review access over time#

Check permissions when people change responsibilities or leave the team. Preserve relevant audit records and distinguish a user's workflow edits from the executions those workflows later produced.

For customer-facing user roles, read App Users and App Roles. Those grants are independent of account-user roles.