Roles and teams
The four roles and what each can do, how teams own services, and who is asked to approve a fix.
Roles
Each role can do everything the one below it can, and more.
| Role | Can |
|---|---|
| Owner | Manage the licence, make people admins or owners, give someone a password, take over as the Keychain's home |
| Admin | Manage connections, policy, the estate, sign-in, mail, branding, the Keychain and installs. Add people and manage every team. Request more autonomy, and resume after a halt |
| Responder | Halt 3AM, withdraw an approval request, record what the team did on an incident. Asked to approve fixes on their teams' services |
| Viewer | See incidents, approvals, the digest, the estate, the audit log, connections (never their secrets) and Doctor. Never asked to approve |
Some rules always hold:
- Only owners can give or change the owner and admin roles.
- The last owner can't be demoted, disabled or removed.
- People can change their own name and contact handles, never their own role.
- The admin token acts as an owner.
The server checks the role on every request. Anything new is closed by default: reads need a viewer, changes need an
admin. A refused request answers 403 with the role it needs.
Teams
A team has a lead and members, owns services, and can sit under a parent team. A team's lead manages it and every team below it, whatever their role. Admins and owners manage every team.
Who is asked to approve
When your policy names no approvers for a service, 3AM asks the team that owns it, in this order:
- the team's responders;
- its lead;
- the leads of the teams above it.
Each person is reached on their own handle for each channel: their Slack ID, pager or phone number, set on their account. To make sure only those people can approve, give every approval channel an approvers list, or put every service in a team.
API
| Call | Who | What it does |
|---|---|---|
GET /v1/me, PUT /v1/me {name, handles} | signed in | Who you are; change your own name and handles |
GET /v1/users, POST /v1/users, PUT, DELETE /v1/users/<id> | admin | People: email, name, role, status, handles |
GET /v1/teams | viewer | Teams, as a list and a tree |
POST /v1/teams, PUT, DELETE /v1/teams/<id> | admin, or a lead above it | Teams: name, parent, lead, members, services |
| Route | Minimum role |
|---|---|
Most GET requests | viewer |
GET /v1/users, /v1/impact, /v1/lookback, /v1/settings/*, /v1/licence/usage | admin |
POST /v1/halt, /v1/approvals/<id>/withdraw, /v1/episodes/<id>/team, /v1/learning/label | responder |
POST /v1/keychain/*, /v1/licence/installs/*, /v1/resume, and any other change | admin |
POST /v1/keychain/take-over, /v1/licence, /v1/licence/check, /v1/licence/redeem, PUT /v1/licence/services, DELETE /v1/licence | owner |