Team and roles

#Roles

Owner

Everything an admin does, plus granting or taking the owner role, removing an owner and deleting the workspace. A workspace always keeps one owner.

Admin

Invites and removes members, changes roles, revokes any API key, and manages alert channels, exclusion rules, redaction, retention and training consent, deletes agents and deletes an end user's data.

Member

Uses the product: agents, stress tests, issues, tests, saved filters, their own preferences and email alerts, and their own API keys.

A member attempting an admin action gets 403 admin_required; an owner-only one answers 403 owner_required. Usage limits change only through Duet Machines, not from the workspace.

#Members and invites

Settings > Members lists members with their role, email and when they were last active, and pending invites among them. Invite by email with a role (admin or member): the invite is a single-use link for that email, valid 7 days, that you can always copy, and it is also emailed when the deployment has email configured. Joining works only for the invited email, with a password or with Google. An account belongs to one workspace at a time.

Removing a member takes effect on their next request: their sessions end, their API keys are deleted and their email alert choices dropped; what they authored stays. Members can leave on their own.

#API keys

Every member creates API keys in Settings > API keys, each for one environment that the conversations it sends land in. A key is shown once and only its hash is stored. It acts as its creator with the creator's current role, and can never manage members, invites or keys. Members revoke their own keys; owners and admins revoke any.

#Audit log

Settings > Audit log shows owners and admins who did what: sign-ins and failed sign-ins (the sign-in page answers alike whether or not the account exists), password resets, invites, joins, role changes and removals, API keys, redaction, exclusion rules, retention, training consent and alert channels, end users' data deleted, agents and configurations created, edited and deleted, issues accepted, dismissed and assigned, reviewer guidance changes, custom signal changes, signal pins and groups, saved filters, datasets, test rebuilds and deletions, comments, and exports downloaded. Each entry names the member (and the API key when one made the request), the target, before and after for settings (never a credential), the time, the client IP and the user agent. An entry is written with the change it records, entries cannot be edited or deleted, and they are kept as long as the workspace exists.

#Sign-in and passwords

Sign in with a password or, where the deployment offers it, Continue with Google (a verified Google email signs in its account; accounts are never matched by email domain). Signing in from a shared link, with either method, opens the shared page. A session lasts 14 days. Forgot your password? emails a password account a link valid 60 minutes; using it signs the account out everywhere. A Google account has no password and gets an email saying to continue with Google.