Docs / Concepts / Roles, grants and key shares
Roles, grants and key shares
Who can read what.
| Owner | Everything, plus transfer and delete. Always has production access. |
| Admin | Manages members, grants, the template and settings. |
| Editor | Pushes and rolls back inside their scope. |
| Viewer | Pulls and reveals inside their scope. |
Scopes
- Project: every environment, file and future key.
- Environment: all files of that environment, including keys added later.
- File: one service file, including keys added later.
- Secret: exactly one key.
Production access
Protected environments, production by default, need a separate flag on the member. Only the owner can turn it on.
Why "pending key share" exists
A grant is the policy and lives on the server. A key share is the capability: the secret's key wrapped for one person. The server never sees a secret's key, so a device that can read the secret has to wrap it. Until that happens the member is allowed in but can't decrypt.