Roles
| Role | Responsibility |
|---|---|
| org_admin | Organization, members, and policies |
| repo_maintainer | Repository maintenance, sync, and build diagnostics |
| release_manager | Snapshot creation, channel promotion and rollback |
| agent_manager | Profiles and client credentials |
| auditor | Audit records |
A member may have multiple roles. Authorization is checked by the server; button visibility is not an access-control boundary.
Separate identities
Console sessions authorize human actions. Source Git credentials fetch repositories. Client tokens read Profile-authorized content. Do not interchange them.
Inject source credentials through protected environment variables or deployment Secrets. The console stores references. Do not embed credentials in repository URLs. Webhooks use separate Secret references.
Client tokens
Registration and rotation return plaintext only once; the database stores hashes. If a response is lost, idempotent replay will not reveal the token: rotate and reconfigure the client. Credentials expire, so monitor and schedule rotation.
Revoked clients cannot renew authorization. Offline reads follow the Profile policy; offline cached availability and instantaneous offline revocation cannot both be guaranteed.
Production sign-in
Production uses OIDC and rejects local passwords. Administrators pre-create members and assign roles. Verified enterprise email binds identities on first sign-in. Configure MFA in your enterprise IdP.
Audit and release confirmation
Search the audit log(console) by actor, action, target, and time. Sensitive updates record before/after state; promotion and rollback record reasons and channel changes.
Channel updates use concurrency control. Refresh and review again after a conflict. Do not bypass release transactions or audit records with direct database edits.