# Manage Team access Invite coworkers, grant least-privilege roles, scope access, and remove it again. Canonical: https://docs.deliberate.space/teams/access/ Invite each person to the Team, then grant only the role and scope needed for their job. Platform roles govern deliberate. resources; your application still owns its end-user authentication and authorization. ## Invite a coworker Use **Team → Members** in the console, or invite from the CLI: ```sh deliberate team members invite developer@example.com --role developer ``` The recipient receives an email with an acceptance link. They can also accept its invite ID from the CLI: ```sh deliberate invite accept ``` Review or cancel invitations that have not been accepted: ```sh deliberate team invites list deliberate team invites cancel ``` ## Choose a role List the current built-in catalogue with `deliberate team roles list`. | Role | Use it for | | --- | --- | | `viewer` | Read-only product access without audit history or secret values | | `developer` | Build, apply, inspect logs, write secrets, and manage alerts without destructive operations or secret reveal | | `operator` | Production operations, including destructive recovery actions and secret reveal, without member or billing administration | | `auditor` | Read-only access including audit history and secret reveal | | `billing` | Usage, invoices, and payment administration without application access | | `admin` | Team administration and product operations, except deleting the Team | | `owner` | Full control, including deleting the Team | `member` is retained as the older broad product-operations role. Prefer the more specific roles above for new grants. ## Restrict access to a Project or Environment class An unscoped role applies across the Team. Restrict it to one Project, one Flow stage such as `production` or `preview-*`, or their intersection: ```sh deliberate team members grant developer@example.com developer \ --project checkout deliberate team members grant on-call@example.com operator \ --project checkout \ --env-class production ``` A person can hold several grants; their effective access is the union of those grants. Use `deliberate team members list` to review the role and scope attached to each person. ## Revoke or remove access Without scope flags, `revoke` removes every grant of that role from the person: ```sh deliberate team members revoke developer@example.com developer ``` Target one scoped grant by repeating its scope. Use `--scoped` to remove only the Team-wide grant while keeping Project or Environment-class grants: ```sh deliberate team members revoke on-call@example.com operator \ --project checkout \ --env-class production deliberate team members revoke on-call@example.com viewer --scoped ``` Remove a person from the Team when they should retain no membership: ```sh deliberate team members remove former-colleague@example.com ``` Private route grants are effective only for current Team members, so removing membership also removes their ability to reach Team-authorized private routes. Review these changes in Team Activity. ## Next steps - [Grant people access to private routes](/private-net/connect/) - [Review recorded Team activity](/security/#review-team-activity) - [Publish a Blueprint for the Team](/blueprints/authoring/)