Members and roles
A workspace is where a team works together: its connections, map, deploys, incidents, and approvals. Each member has one role in it, which decides what they can start, approve, and change.
Workspaces
Your first sign-in creates a workspace with you as its owner. You can create more, for example one per client or per environment, and be a member of workspaces other people own. Nothing is shared between workspaces: each one has its own connections, map, history, limits, and audit log.
A person who is not a member of a workspace cannot see that it exists. Groundcrew answers as if it were not there.
The three roles
- Owner: manages members, connections, and settings, and approves everything. A workspace always has at least one owner.
- Approver: starts deploys, discovery, and investigations, and approves deploy plans and fixes. Emergency actions too, if an owner allows it.
- Viewer: sees everything in the workspace and changes nothing.
New members are viewers unless the owner who adds them picks another role.
Who can do what
| Action | Owner | Approver | Viewer |
|---|---|---|---|
| See the map, runs, deploys, incidents, approvals, and activity | Yes | Yes | Yes |
| Start discovery or refresh a connection | Yes | Yes | No |
| Start a deploy, report an incident, stop a run | Yes | Yes | No |
| Approve or reject deploy plans and fix pull requests | Yes | Yes | No |
| Approve emergency actions (rollbacks, restarts) | Yes | No | No |
| Add, change, or remove connections | Yes | No | No |
| Change workspace name, settings, limits, notifications | Yes | No | No |
| Add members, change roles, remove people | Yes | No | No |
| Delete the workspace | Yes | No | No |
Emergency actions are owners only by default. In Settings, Approvals and limits, an owner can choose Owners and approvers instead. Rejecting is always open to owners and approvers. Viewers never approve or reject.
Roles are checked by the server on every request, not only hidden in the interface. A viewer who calls the API directly gets the same refusal.
Adding people
In Settings, Members, an owner adds someone by email address or by GitHub login, and picks a role:
- Someone who already has a Groundcrew account with that confirmed address, or that GitHub account, joins at once.
- Anyone else gets an invite that applies when they sign up or sign in. An invite by email address is also sent by email. They join once their address is confirmed, through an email sign-in link or a GitHub sign-in with that verified address.
Pending invites are listed under Members, where an owner can change their role or cancel them. Every addition, invite, and cancellation is in the activity log.
Changing roles and removing people
Owners change a member's role or remove them under Members. A change takes effect on that person's next request. The last owner cannot be demoted or removed: make someone else an owner first.
Removing someone does not undo what they did. Their name stays on approvals they made and in the activity log, as a record of who did it.
Leaving a workspace
Any member can leave a workspace with Leave workspace at the bottom of Settings. Your other workspaces are not affected. If you are the only owner of a shared workspace, make someone else an owner before you leave.
Your account and sign-in
On groundkrew.com you sign in with GitHub or with an emailed sign-in link. The same verified email address is the same account, whichever way you sign in. To delete your account and the workspaces only you are in, see Delete data.