Manage access

Access in a namespace is organized around teams. Users belong to teams, teams carry permissions, and firewalls grant permissions to teams. There are no per-user grants; to give one person special access, give them a team.

For the underlying model, see Access and permissions. This page is the task view.

The two built-in teamsCopy Anchor Link

Every namespace has two protected teams that cannot be edited or deleted:

• everybody contains all users. It grants namespace access, PAT creation, firewall creation, and read access to firewalls.
• admin members can additionally manage teams, create Service Access Tokens, and get full write access to firewalls.

Everyone in your organization can open every namespace in it. The first time someone opens a namespace, they are added to its everybody team. Adding someone to any other team also adds them to everybody, so you can give a colleague access before they have opened the namespace. You cannot add or remove everybody members yourself, which is why its team page has no Add member button.

The permissions of everybody apply to every member of the namespace. Other teams can only add permissions; they cannot take away one that everybody grants. In a new namespace this means:

• Every user can read every firewall, create firewalls, and create personal access tokens.
• Admins can change everything.

To let a specific group of people change specific firewalls, create a team for them.

Create a team and add membersCopy Anchor Link

1. In the dashboard, open Teams and choose Create team. Give it a name and an optional description.
2. Open the team and use Add member to add users. The picker lists everyone in your organization by name, minus current members, including people who have not opened the namespace yet. Users can be members of multiple teams.
3. Set the team's permissions. These are namespace-level: they cap what members can do anywhere in the namespace.

A sensible starting shape is one team per area of responsibility, for example a platform team that manages firewall configuration and a security team that manages rules and exceptions.

Grant a team access to a firewallCopy Anchor Link

Firewall write access is granted per firewall:

1. Open the firewall and go to its access settings.
2. Choose Add team and select the team.
3. Pick the permissions the team should have on this firewall, for example rule and exception updates but not configuration or deletion.

A new firewall starts with read access (fw:access, fw:clone, fw:read) for everybody and the full permission set for the owner team named at creation; without one, the full set also goes to everybody. Defaults and the guard against locking a firewall out of management: Permissions.

How the two levels combineCopy Anchor Link

A user's effective permissions on a firewall are the firewall's grants to their teams, limited by their namespace-level permissions. Both levels must allow an action:

• A firewall grant without the namespace permission does nothing.
• A namespace permission without a firewall grant gives no access to that firewall.

Tokens can narrow this further; a Personal Access Token never grants more than the user's teams do. See Manage tokens.

VerifyCopy Anchor Link

Have a member of the team open the firewall in the dashboard and attempt the granted action, for example editing a rule. Then confirm an action they should not have is rejected. Permission denials are recorded in the audit log with the missing permission.

RelatedCopy Anchor Link

• Concept: Access and permissions
• Reference: Permissions
• How-to: Manage tokens
• Platform: Authentication, how the users in the picker sign in