BytesafeDependency Firewall
How-to guides

Manage access

Organize users into teams, set namespace permissions, and grant teams access to specific firewalls.

Access in a namespace is organized around teams. Users belong to teams, teams carry permissions, and firewalls grant permissions to teams. There are no per-user grants; to give one person special access, give them a team.

For the underlying model, see Access and permissions. This page is the task view.

The two built-in teams

Every namespace has two protected teams that cannot be edited or deleted:

  • everybody contains all users. It grants namespace access, PAT creation, firewall creation, and read access to firewalls.
  • admin members can additionally manage teams, create Service Access Tokens, and get full write access to firewalls.

Membership in everybody is what makes someone a member of the namespace at all: a user has to be in it before they can be added to any other team. Its permissions are therefore the floor for everyone. Teams add permissions on top; they cannot take away what everybody already grants.

Day one, every user can read every firewall and admins can change everything. Teams beyond that exist to grant write access more precisely.

Create a team and add members

  1. In the dashboard, open Teams and choose Create Team. Give it a name and an optional description.
  2. Open the team and use Add Member to add users. The picker lists everyone in your organization by name, minus current members. Users can be members of multiple teams.
  3. Set the team's permissions. These are namespace-level: they cap what members can do anywhere in the namespace.

A sensible starting shape is one team per area of responsibility, for example a platform team that manages firewall configuration and a security team that manages rules and exceptions.

Grant a team access to a firewall

Firewall write access is granted per firewall:

  1. Open the firewall and go to its access settings.
  2. Choose Add Team and select the team.
  3. Pick the permissions the team should have on this firewall, for example rule and exception updates but not configuration or deletion.

A new firewall starts with read access (fw:access, fw:clone, fw:read) for everybody and the full permission set for the owner team named at creation; without one, the full set also goes to everybody. Defaults and the guard against locking a firewall out of management: Permissions.

How the two levels combine

A user's effective permissions on a firewall are the firewall's grants to their teams, limited by their namespace-level permissions. Both levels must allow an action:

  • A firewall grant without the namespace permission does nothing.
  • A namespace permission without a firewall grant gives no access to that firewall.

Tokens can narrow this further; a Personal Access Token never grants more than the user's teams do. See Manage tokens.

Verify

Have a member of the team open the firewall in the dashboard and attempt the granted action, for example editing a rule. Then confirm an action they should not have is rejected. Permission denials are recorded in the audit log with the missing permission.

Investigate a blocked install

Trace a failed install back to the firewall rule that caused it, and decide what to do about it.

Manage config as code

Run firewall policy from a git repository. Repository layout, review flow, applying from CI, drift detection, and rollback.

On this page

The two built-in teamsCreate a team and add membersGrant a team access to a firewallHow the two levels combineVerifyRelated