Team & roles
Roles map onto the same three bands the API uses. There is no second permission vocabulary to keep in your head.
Approval is not a band. Every role except viewer can draft; only owner and admin can approve a gated task. That right is never granted to an API key, and an agent cannot grant it to itself — the check lives in the key-issuing path.
Members (5)
Last active is drawn from the activity log, so it counts API use as well as dashboard visits.
| Member | Role | Bands | Can approve | Last active | |
|---|---|---|---|---|---|
| PRPriya Ramanpriya@acme.com | owner | readdraft | 5h ago | ||
| DODaniel Okorodaniel@acme.com | admin | readdraft | 21h ago | ||
| MTMei Tanakamei@acme.com | editor | readdraft | — | 2d ago | |
| SWSam Whitfieldsam@acme.com | viewer | read | — | 6d ago | |
| AFAna Ferreiraana@contractor.dev | editorinvited | readdraft | — | never |
Invite
They get read access until you raise it.
What each role can do
Four roles, because five is where people stop reading the table.
ownerreaddraftcan approve gatedissues keys
Billing, key issuance, and approval of gated tasks.
adminreaddraftcan approve gatedissues keys
Everything except billing.
editorreaddraft
Can draft fixes and add prompts. Cannot approve them.
viewerread
Read-only across every screen.
Audit
Every approval, rejection and key issuance is written to the activity log with the person's name against it. That log is the record a security review actually reads.