Team & roles

Roles map onto the same three bands the API uses. There is no second permission vocabulary to keep in your head.

Approval is not a band. Every role except viewer can draft; only owner and admin can approve a gated task. That right is never granted to an API key, and an agent cannot grant it to itself — the check lives in the key-issuing path.

Members (1)

Last active is drawn from the activity log, so it counts API use as well as dashboard visits.

Just you so far

Invite the people who will act on what this finds — usually whoever owns the site, and whoever reviews the pull requests.

Member	Role	Bands	Can approve	Last active
PRPriya Ramanpriya@acme.com	owner	readdraft		5h ago

Invite

They get read access until you raise it.

EmailRoleYou can change this at any time; changes take effect on their next request.

What each role can do

Four roles, because five is where people stop reading the table.

ownerreaddraftcan approve gatedissues keys

Billing, key issuance, and approval of gated tasks.

adminreaddraftcan approve gatedissues keys

Everything except billing.

editorreaddraft

Can draft fixes and add prompts. Cannot approve them.

viewerread

Read-only across every screen.

Audit

Every approval, rejection and key issuance is written to the activity log with the person's name against it. That log is the record a security review actually reads.

Open the call log