Collaboration Roles & Policies

Collaboration Roles and Policies

Collaboration roles and policies provide flexible access control for shared cloud resources. They allow the primary account to define exactly which environments a team member can access and which actions that member is authorised to perform.

Policies

Policies are focused permission sets that allow specific platform operations, such as viewing logs, restarting containers or managing environments.

Roles

Roles combine multiple policies into a reusable access profile that can be assigned to collaboration members.

In this article

Manage Collaboration Policies

Open the account settings and navigate to Shared by Me. The collaboration area contains separate sections for policies, roles, members and shared resources.

Account settings with Shared by Me section
Open collaboration settings from Shared by Me.

The Policies tab displays the available actions that can be included in roles. System policies cover common collaboration operations and can be combined for different responsibilities.

✓

Recommended practice

Build roles according to actual job responsibilities. Avoid assigning broad permissions when a smaller combination of policies is sufficient.

Create and Manage Roles

The Roles tab allows administrators to create reusable permission sets. Roles can be added, edited, copied or removed as access requirements change.

Role NameEnter a clear name that describes the responsibility or access level.
DescriptionAdd an optional explanation of the role’s purpose.
PoliciesSelect the actions permitted for users assigned to the role.
Load AlertsEnable notifications when members with this role should receive shared-environment load alerts.

Common Role Examples

ViewerRead-only access to logs, files and monitoring information.
UserBasic actions such as starting or stopping environments and restarting containers.
DeveloperAccess to most application-management features with selected restrictions.
AdministratorBroad access including environment creation, package installation and SSH operations.

Role Assignment Algorithm

When an environment is covered by more than one role assignment, the platform evaluates three access levels from highest to lowest priority.

1
Direct AssignmentRoles assigned directly to a specific environment. These override all lower levels.
2
Shared Environment GroupsRoles inherited from shared groups. Parent groups are checked when a child group has no role.
3
Base AssignmentDefault roles assigned to all shared environments and used only when no higher role exists.
i

Important

Only roles from the highest applicable access level are used. Lower-level roles are ignored.

Members can review assigned roles from Account Settings → Shared with Me. For a specific environment, open Environment Settings → Collaboration.

Role Assignment Examples

Example 1: Base Role Only

The environment is not shared directly and is not part of a shared group. A default Viewer role is assigned to all environments.

Result: The environment receives the Viewer role.

Example 2: Direct Role Overrides Group Role

The environment has a direct Viewer role and belongs to a group with an Administrator role. The direct assignment has higher priority.

Result: Only the Viewer role is applied.

Example 3: Combined Roles from Multiple Groups

The environment belongs to two shared groups. One provides Developer and Accountant roles; the other inherits the default Viewer role. All roles are from the same access level.

Result: Policies from Developer, Accountant and Viewer are combined.

Expected Result

Collaboration members receive the exact access required for their responsibilities. Policies define individual actions, roles combine those actions into reusable profiles, and the assignment algorithm determines which access level applies to each shared environment.

Important Notes

  • Use the principle of least privilege.
  • Direct roles override group and base roles.
  • Roles from the same shared-group level may be combined.
  • Parent groups are checked when a child group has no role.
  • Base roles apply only when no higher-priority role exists.
  • Review role assignments whenever responsibilities change.

What’s next?