# Teams and access management Team Access lets an account owner give other people console access to selected Gateman applications. It controls which applications a member can manage; it does not create separate read-only, developer, or administrator roles. ## Owners and members Gateman has two team roles. **Owner** The owner manages the account, team, and billing. The owner can create and delete applications and can access every application in the account. Owners cannot be disabled through the Team management workflow. **Member** A member can manage the applications the owner has authorized. This includes the available application configuration, capabilities, provider credentials, and other supported settings for those applications, including sensitive settings where the console provides them. Members cannot manage the team or billing, and cannot create or delete applications. ## Application access Each member has one of two application-access options: - **All applications** gives access to every application in the account, including applications created later. - **Selected applications** gives access only to the applications explicitly selected by the owner. A newly created application is not included automatically. These options limit which applications the member can manage. They are not different permission levels inside an application. ## Invite a team member An owner can invite a member from the console: 1. Open **Team**. 2. Enter the member's **Email address**. 3. Choose **All applications** or **Selected applications**. 4. If you choose selected access, choose the relevant applications. 5. Click **Send invitation**. Gateman sends the invitation by email. An invitation is valid for seven days, and reserves one Team Access member slot while it is pending. Owners can revoke pending invitations from the **Pending invitations** section; a revoked invitation can no longer be accepted. Invitees do not need an existing Gateman account. Someone new to Gateman creates their first name, last name, and password while accepting the invitation. An existing Gateman user confirms the invitation with their existing password. Accepting the invitation establishes membership in the account with the access option chosen by the owner. An expired invitation cannot be accepted. Expiring or revoking an invitation is different from disabling a member who has already accepted one. ## Change a member's access Owners can change application access from **Team**: 1. Find the member in the **Members** table. 2. Change **All applications** or **Selected applications**. 3. When using selected access, update the application checkboxes. 4. Click **Save access**. Selected access must include at least one application. Changing from selected access to all applications removes the selection restriction. Changing from all applications to selected access limits the member to the applications chosen in that save action. ## Disable a team member To disable an existing member: 1. Open **Team**. 2. Find the member. 3. Click **Disable**. 4. Confirm the action. Disabling changes the membership to disabled rather than deleting the user account. It revokes the member's account and application access. The current Team interface has no separate re-enable control. A disabled member can regain membership if the owner sends a new invitation and the member accepts it. ## When access changes take effect **Access changes take effect on the next authenticated console request, even if the team member is already signed in.** Gateman checks current team membership and application authorization when an authenticated console request is made. Disabling a member therefore denies their subsequent console requests. Removing one application from selected access denies requests for that application while access to other authorized applications continues. Granting or restoring access takes effect on a later request without requiring the member to sign out and sign back in. Disabling a member does not need to terminate their existing session for revocation to work. The session can remain present, but it does not preserve authorization after the membership or application permission has changed. A page already displayed in the browser may remain visible until it is refreshed. A request already in progress is not cancelled retroactively. The guarantee is that authorization is checked on the next authenticated request; it is not a promise of forced logout, page removal, or a fixed delay in seconds. ## Application authentication is separate Team members sign in to Gateman's console to manage applications. Applications authenticate to Gateman's runtime API with their own signing credentials, as described in [Authentication](https://docs.getgateman.com/authentication/). Disabling a team member or changing their console access does not disable an application or rotate its signing credentials. The application's runtime integration continues independently of that member's console session. Team access changes also do not automatically revoke provider credentials or other secrets that may previously have been disclosed to a person. ## Related references - [What is Gateman?](https://docs.getgateman.com/what-is-gateman/) for the overall account and application model. - [Authentication](https://docs.getgateman.com/authentication/) for application runtime authentication and signing.