Gateman
Documentation/Teams and access management

Teams and access management

Team Access lets an account owner give other people console access to selected Gateman applications. It controls which applications a member can manage; it does not create separate read-only, developer, or administrator roles.

Owners and members

Gateman has two team roles.

Owner

The owner manages the account, team, and billing. The owner can create and delete applications and can access every application in the account. Owners cannot be disabled through the Team management workflow.

Member

A member can manage the applications the owner has authorized. This includes the available application configuration, capabilities, provider credentials, and other supported settings for those applications, including sensitive settings where the console provides them. Members cannot manage the team or billing, and cannot create or delete applications.

Application access

Each member has one of two application-access options:

  • All applications gives access to every application in the account, including applications created later.
  • Selected applications gives access only to the applications explicitly selected by the owner. A newly created application is not included automatically.

These options limit which applications the member can manage. They are not different permission levels inside an application.

Invite a team member

An owner can invite a member from the console:

  1. Open Team.
  2. Enter the member's Email address.
  3. Choose All applications or Selected applications.
  4. If you choose selected access, choose the relevant applications.
  5. Click Send invitation.

Gateman sends the invitation by email. An invitation is valid for seven days, and reserves one Team Access member slot while it is pending. Owners can revoke pending invitations from the Pending invitations section; a revoked invitation can no longer be accepted.

Invitees do not need an existing Gateman account. Someone new to Gateman creates their first name, last name, and password while accepting the invitation. An existing Gateman user confirms the invitation with their existing password. Accepting the invitation establishes membership in the account with the access option chosen by the owner.

An expired invitation cannot be accepted. Expiring or revoking an invitation is different from disabling a member who has already accepted one.

Change a member's access

Owners can change application access from Team:

  1. Find the member in the Members table.
  2. Change All applications or Selected applications.
  3. When using selected access, update the application checkboxes.
  4. Click Save access.

Selected access must include at least one application. Changing from selected access to all applications removes the selection restriction. Changing from all applications to selected access limits the member to the applications chosen in that save action.

Disable a team member

To disable an existing member:

  1. Open Team.
  2. Find the member.
  3. Click Disable.
  4. Confirm the action.

Disabling changes the membership to disabled rather than deleting the user account. It revokes the member's account and application access. The current Team interface has no separate re-enable control. A disabled member can regain membership if the owner sends a new invitation and the member accepts it.

When access changes take effect

Access changes take effect on the next authenticated console request, even if the team member is already signed in.

Gateman checks current team membership and application authorization when an authenticated console request is made. Disabling a member therefore denies their subsequent console requests. Removing one application from selected access denies requests for that application while access to other authorized applications continues. Granting or restoring access takes effect on a later request without requiring the member to sign out and sign back in.

Disabling a member does not need to terminate their existing session for revocation to work. The session can remain present, but it does not preserve authorization after the membership or application permission has changed.

A page already displayed in the browser may remain visible until it is refreshed. A request already in progress is not cancelled retroactively. The guarantee is that authorization is checked on the next authenticated request; it is not a promise of forced logout, page removal, or a fixed delay in seconds.

Application authentication is separate

Team members sign in to Gateman's console to manage applications. Applications authenticate to Gateman's runtime API with their own signing credentials, as described in Authentication.

Disabling a team member or changing their console access does not disable an application or rotate its signing credentials. The application's runtime integration continues independently of that member's console session. Team access changes also do not automatically revoke provider credentials or other secrets that may previously have been disclosed to a person.