Roadmap relationship
Outcome
Support multiple people and teams in one control plane with explicit organization membership and least-privilege grants at project, environment, service, and operational-capability scopes.
Current gap
The current dashboard has an admin/member model backed by a local user file and site-only grants. It cannot express read-only operators, deployers, database administrators, auditors, automation managers, or access across multiple projects.
User experience
- Add organization and member settings with pending invitations, role summaries, last activity, and clear inherited-versus-direct access.
- Provide role templates for owner, admin, developer/deployer, operator, viewer, and auditor plus advanced custom grants later.
- Resource pages explain why an action is unavailable and where inherited access came from.
- Invitation acceptance, expiration, resend, revoke, and membership removal have explicit states and recovery guidance.
Scope
- Model organizations, memberships, invitations, role templates, grants, and resource ancestry in the control-plane store.
- Define granular capabilities for project/config, deployments, runtime, data, backups, secrets, fleet, users, audit, and automation credentials.
- Migrate current admin/member/site grants without increasing access.
- Update dashboard policy tests so every route and service method declares its required capability.
- Add CLI/API read and management commands for organization administrators.
Technical direction
- Centralize authorization in a deny-by-default policy engine shared by dashboard, API, WebSocket/event subscriptions, and CLI tokens.
- Evaluate resource ancestry and explicit deny semantics deterministically; cache decisions only with safe invalidation.
- Store invitation tokens hashed with expiry and single-use semantics.
- Emit audit events for invitations, membership, roles, and grants.
Safety and operability
- Prevent the last owner from being removed and require reauthentication for ownership transfer.
- Revocation invalidates active sessions/tokens promptly.
- Bulk role changes show the effective-access diff before confirmation.
- No cross-organization IDs or counts leak through search, events, or errors.
Acceptance criteria
- An owner can invite a deployer to one environment without granting secrets, terminals, databases, or other environments.
- A viewer can inspect allowed resources but cannot trigger mutations through any interface.
- Existing users migrate to equivalent or narrower effective permissions.
- Every HTTP and event-stream route has policy coverage enforced by tests.
Verification
- Authorization matrix tests across roles, scopes, inheritance, revocation, and guessed IDs.
- Invitation expiry/replay and last-owner protection tests.
- End-to-end two-organization isolation and session revocation tests.
Non-goals
- Enterprise SCIM provisioning in the first iteration.
- Cloud-provider IAM user creation for each dashboard user.
- Relying on hidden buttons as authorization.