Roles and access
You’ll create roles in an organization, pick what they can view or change, optionally limit them to certain environments, and assign those roles to members.
Roles are per organization. A member can have several roles; permissions and environments are combined (union). There is no extra ACL inside an environment — if they can open apps there, they can use the app screens you granted.
Before you start
- You are the organization owner, or a member whose role includes managing members.
- Teammates already belong to the organization (add them first).
Full access vs a custom role
Until you assign a custom role, existing members keep Full access: apps, databases, logs, terminal, backups, monitoring, Argus, wallet, tickets, and AI — everything except adding or removing people.
On a cluster owned by this organization, Full access also opens the cluster panel the owner sees: nodes, cluster settings, and registries. On a shared cluster, Full access stays inside the environments you assigned. It does not become cluster owner there, and it cannot create new environments.
The first custom role you assign replaces Full access for that person. If you leave Full access checked together with a custom role, they stay unrestricted.
New custom roles do not include terminal unless you turn it on.
Create a role
- Open Organization settings → roles.
- Create a role and give it a clear name (for example
Logs and env — payments). - Enable view and/or change on the surfaces they need. Examples:
- Logs only: Logs (view)
- Logs plus variables: Logs (view) and Environment variables (view + change)
- Outbound proxy: General (view + change) — same permission as image, port, and probes
- Databases: Databases overview / create
- Argus uptime: Argus (view / change)
- Cluster monitoring and backups: Cluster monitoring (view), Cluster backups (view / change)
- Health alert channels: Health alert channels (view / change)
- Optionally select environments. Leave the list empty to allow every environment this organization owns. On a public (shared) cluster, staff only work in environments you already assigned — they cannot create new ones.
- Save.
Coming-soon items in the sidebar (scheduled tasks, registry, Sentry) are not separate permissions yet.
Assign roles
- Open Organization settings → members.
- Edit the member’s roles.
- Select the custom role(s). Uncheck Full access when you want the restriction to apply.
- Save.
The dashboard hides buttons and tabs they cannot use (New app, wallet, AI Mode, cluster create, manage environments, and so on). Saving an app sends the whole form; Xooshe only checks the fields that actually changed, so an env-only role can save variables without a resources permission.
You’re done when
- The member sees only the clusters / environments and screens you granted.
- They can change what you allowed (for example env vars) and get access denied on the rest.
- Switching organization no longer shows another org’s cluster with the wrong buttons.
If it fails
| Symptom | Fix |
|---|---|
| Buttons greyed out after switching org | Select a cluster that belongs to that organization |
| Env save returns access denied | Confirm the role has change on environment variables, and that Full access was removed |
| Member still sees everything | Assign only the custom role — Full access overrides the restriction |
| Cannot add a teammate | They need an existing account; you need member-management permission |
| Terminal missing | Grant terminal on the role (it is off by default) |