The page hides every control your role cannot use. That is a convenience, not the protection: the service checks the role on every request, so a request made another way is refused with 403 forbidden and recorded in the audit log as denied. The full role model is in Teams and roles.
assert.deepEqual([...ROLE_ACTIONS.viewer], ["read"]);
assert.ok(ROLE_ACTIONS.member.includes("manage_tokens"));
assert.ok(!ROLE_ACTIONS.member.includes("manage_members"));
assert.ok(ROLE_ACTIONS.admin.includes("manage_members"));
assert.ok(!ROLE_ACTIONS.admin.includes("manage_team"));
assert.ok(ROLE_ACTIONS.owner.includes("manage_team"));Permissions by role
| In the app | Viewer | Member | Admin | Owner |
|---|---|---|---|---|
| Read every view | yes | yes | yes | yes |
| Create and edit issues, memory and projects | no | yes | yes | yes |
| Dismiss a review finding, re-run CI | no | yes | yes | yes |
| Approve a deploy, roll one back, change policy | no | no | yes | yes |
| Create and revoke agent tokens | no | yes | yes | yes |
| Change roles, remove members, invite people | no | no | yes | yes |
| Read, verify and export the audit log | no | no | yes | yes |
| Manage the team itself | no | no | no | yes |
Members and invitations
In Settings > Members everyone can read the list. Owners and admins can change a role, remove a member and send or revoke invitations. Nobody can give out more authority than they hold: only an owner can make someone an owner, and a team always keeps at least one owner.
Removing a member takes effect at once. Their sessions stop working and the agent tokens they created are revoked.
An invitation is bound to one email address and works once. If no email could be sent, the page shows the invitation link a single time.
Agent tokens
Settings > Agent access lists the tokens agents hold and lets you revoke one. Nobody creates a token there: agents sign in from the CLI, with overlane auth login when a person can approve a code, or on their own for a repository connected through the Overlane GitHub App. Read more in Agent sign-in.