Access Management

Access in Codesphere is granted through roles on three levels: the Organization, its Resource Groups (formerly Teams), and the Workspaces inside each Resource Group. Two rules hold on every level:

• A role includes every role below it. A Workspace Admin can do everything an Editor can, and an Editor everything a Viewer can.
• Roles flow down. A role on an Organization or Resource Group implies a role on everything inside it, so you assign a person once instead of on every Workspace.

How roles are inherited

• includes every permission of the role below
• grants this role on everything inside
• only Organization Members can join a Resource Group

Corresponding accessible text description

• Organization Owner is automatically Admin of every Resource Group in the Organization, and therefore Admin of every Workspace.
• Resource Group Admin is automatically Admin of every Workspace in that Resource Group.
• Resource Group Member is automatically Viewer of every Workspace in that Resource Group. A Workspace Admin can raise a Member to Editor or Admin on individual Workspaces.
• Only Organization Members can join a Resource Group, and only Resource Group Members can be given a role on its Workspaces. Removing someone from the Organization therefore removes their access everywhere in it.

An inherited role is a floor, not a ceiling. You can assign a higher role on a Workspace, but assigning the same or a lower one has no effect. To reduce someone's access, change their role where it is inherited from.

Organization roles

Role	What it allows
Owner	Manage the Organization's settings and members, invite users, change Organization roles, and create Resource Groups. Admin of every Resource Group and Workspace in the Organization.
Member	No administrative rights on the Organization itself. Can be added to Resource Groups and can leave the Organization.

An Organization must always have at least one Owner. The last Owner has to assign the Owner role to someone else before leaving.

Resource Group roles

Permission	Member	Admin
View the Resource Group, its Workspaces, members and observability status	✓	✓
View IPs, domains and VPN configurations	✓	✓
View Managed Services and the Managed Service provider catalog	✓	✓
View container image registries	✓	✓
See which secrets the shared vaults hold, without their values	✓	✓
Create Workspaces	✓	✓
View resource usage		✓
Change the name, description and avatar		✓
Add and remove members and change their roles		✓
Manage IPs, domains and VPN configurations		✓
Create and manage Managed Services and register Managed Service providers		✓
Manage container image registries		✓
Create and delete shared vaults and write their secrets		✓
Start and stop the observability platform		✓
Delete the Resource Group		✓

Workspace roles

Permission	Viewer	Editor	Admin
Open the Workspace and view its files, logs and metrics	✓	✓	✓
Edit files in the IDE		✓	✓
Use the terminal and run commands		✓	✓
Configure and run the Landscape: pipelines, deployments, environment variables and secrets		✓	✓
Change the Workspace's settings and plan, and delete the Workspace		✓	✓
Assign and revoke Workspace roles			✓

Whoever creates a Workspace becomes its first Admin.

Assigning roles

• Organization roles are set on the Organization's Members page by an Owner.

• Resource Group roles are set on the Resource Group's Members page by an Admin. Members whose role comes from the Organization are marked as inherited.

• Workspace roles are set in the Workspace settings under Access:

  1. Click Add Role Assignment and select a Resource Group member.
  2. Pick the role and click Save Changes.

  The list shows each person's assigned role, marks the Workspace's creator, and shows a role inherited from the Resource Group next to it.

note

When Workspace roles were introduced, members of a Resource Group kept Editor access to the Workspaces that already existed. Workspaces created afterwards follow the rules above, so Members start as Viewers.