Teams

Teams provide a flexible way to manage project access in your organization. Instead of assigning individual users to projects, you create teams, add members to teams, and then grant teams access to projects with specific roles.

Plan Limits

Team member limits vary by plan:

Overview

The team-based access control system follows the GitHub/GitLab model:

• Teams are groups of users within your organization
• Team Members are users assigned to a team
• Project Access is granted by assigning teams to projects with a role (Admin, Developer, or Viewer)

This approach makes it easy to:

• Onboard new team members by adding them to relevant teams
• Manage access for multiple projects at once
• Audit who has access to what
• Scale access management as your organization grows

Key Concepts

Teams

A team is a named group of users within your organization. Each team has:

• Name: A descriptive name (e.g., "Backend Team", "Client Alpha Team")
• Description: Optional details about the team's purpose
• Color: A badge color for visual identification in the UI
• Members: Users who belong to the team

Team Roles on Projects

When you assign a team to a project, you specify a role that determines what team members can do:

Access Resolution

When a user belongs to multiple teams that have access to the same project, they get the highest role from any of their teams:

Admin > Developer > Viewer

Special Case: Organization Owner

• Organization Owners always have Admin access to all projects in their organization
• This serves as a safety net to ensure owners can never be locked out

Managing Teams

Creating a Team

1. Go to Settings > Teams
2. Click Create Team
3. Enter a name and optional description
4. Select a badge color
5. Click Create

Adding Members to a Team

1. Go to Settings > Teams
2. Click on the team name to open details
3. Click Add Members
4. Search and select organization members to add
5. Click Add Selected

Removing Members from a Team

1. Go to Settings > Teams
2. Click on the team name
3. Find the member in the list
4. Click the remove button (trash icon)

Assigning Teams to Projects

Granting Project Access

1. Go to Projects > Select a project > Settings > Teams
2. Click Assign Team
3. Select one or more teams from your organization
4. Choose a role (Admin, Developer, or Viewer)
5. Click Assign

Changing Team Role on a Project

1. Go to Projects > Select a project > Settings > Teams
2. Find the team in the list
3. Click on the role dropdown
4. Select the new role

Removing Team Access

1. Go to Projects > Select a project > Settings > Teams
2. Find the team in the list
3. Click the remove button (trash icon)
4. Confirm the removal

Permissions & RBAC

OEC.sh uses a comprehensive Role-Based Access Control (RBAC) system with 55+ granular permissions across 6 system roles.

System Roles

The platform has 6 predefined roles organized in a hierarchy:

Portal Level:

• Portal Admin - Full platform access (OEC.sh staff only)

Organization Level:

• Owner - Full organization access, billing, member management
• Admin - Organization management without billing access
• Developer - Create projects, deploy environments
• Viewer - Read-only access to organization resources

Project Level:

• Team Admin - Full project access via team assignment
• Team Developer - Deploy and manage environments via team
• Team Viewer - View-only project access via team

Organization-Level Permissions

Project-Level Permissions

Best Practices

Team Structure

• By Function: "Backend Team", "Frontend Team", "DevOps Team"
• By Project/Client: "Client Alpha Team", "Internal Projects Team"
• By Access Level: "Project Admins", "Developers", "Stakeholders"

Access Management

1. Start with minimal access: Assign Viewer role by default, escalate as needed
2. Use descriptive team names: Make it clear who should be in each team
3. Regular audits: Periodically review team memberships and project assignments
4. Document team purposes: Use the description field to explain each team's role

Onboarding New Users

1. Add the user to your organization
2. Add them to the appropriate teams
3. They automatically gain access to all projects those teams can access

Offboarding Users

1. Remove the user from all teams (or remove from organization)
2. Their access to all team-based projects is automatically revoked

API Reference

Teams Endpoints

Project Teams Endpoints

Troubleshooting

User can't access a project

1. Verify the user is a member of a team
2. Verify that team has been assigned to the project
3. Check the team's role on the project has sufficient permissions

Changes not taking effect

• Permission changes may take up to 5 minutes due to caching
• Ask the user to refresh their browser
• If urgent, the user can log out and log back in

Can't delete a team

• Teams with project assignments cannot be deleted
• Remove the team from all projects first, then delete