Manage Team access

Invite each person to the Team, then grant only the role and scope needed for their job. Platform roles govern deliberate. resources; your application still owns its end-user authentication and authorization.

Invite a coworker

Use Team → Members in the console, or invite from the CLI:

deliberate team members invite developer@example.com --role developer

The recipient receives an email with an acceptance link. They can also accept its invite ID from the CLI:

deliberate invite accept <invite-id>

Review or cancel invitations that have not been accepted:

deliberate team invites list
deliberate team invites cancel <invite-id>

Choose a role

List the current built-in catalogue with deliberate team roles list.

Role	Use it for
viewer	Read-only product access without audit history or secret values
developer	Build, apply, inspect logs, write secrets, and manage alerts without destructive operations or secret reveal
operator	Production operations, including destructive recovery actions and secret reveal, without member or billing administration
auditor	Read-only access including audit history and secret reveal
billing	Usage, invoices, and payment administration without application access
admin	Team administration and product operations, except deleting the Team
owner	Full control, including deleting the Team

member is retained as the older broad product-operations role. Prefer the more specific roles above for new grants.

Restrict access to a Project or Environment class

An unscoped role applies across the Team. Restrict it to one Project, one Flow stage such as production or preview-*, or their intersection:

deliberate team members grant developer@example.com developer \
  --project checkout

deliberate team members grant on-call@example.com operator \
  --project checkout \
  --env-class production

A person can hold several grants; their effective access is the union of those grants. Use deliberate team members list to review the role and scope attached to each person.

Revoke or remove access

Without scope flags, revoke removes every grant of that role from the person:

deliberate team members revoke developer@example.com developer

Target one scoped grant by repeating its scope. Use --scoped to remove only the Team-wide grant while keeping Project or Environment-class grants:

deliberate team members revoke on-call@example.com operator \
  --project checkout \
  --env-class production

deliberate team members revoke on-call@example.com viewer --scoped

Remove a person from the Team when they should retain no membership:

deliberate team members remove former-colleague@example.com

Private route grants are effective only for current Team members, so removing membership also removes their ability to reach Team-authorized private routes. Review these changes in Team Activity.

Next steps

• Grant people access to private routes
• Review recorded Team activity
• Publish a Blueprint for the Team