Groups & Project Permissions
Groups are how organization members get access to projects. An organization Owner or Admin can see and manage everything (except any capabilities your platform operator has reserved — see below); everyone else starts with no project access at all. You add people to a group, then grant that group a set of capabilities on each project it should be able to work with.
Group management lives in the dashboard. The paas CLI has no group
commands today.
Create a group
- In the dashboard, open your organization and go to Organization Settings → Groups.
- Click New Group.
- Enter a group name (required) and an optional description, then click Create group.
The new group opens immediately so you can add members and grant project access. Only organization Owners and Admins can create, manage, or delete groups.
Add members to a group
With the group open (click Manage next to it in the list):
- Use the Add a member… dropdown. It lists organization members who are not yet in the group.
- Pick a person and click Add member.
Remove someone with the Remove button next to their name. Removing them from the group takes away the project access the group granted; it does not remove them from the organization.
People must already be organization members before you can add them to a group — see Inviting People.
Grant a group access to a project
In the group’s Project Access section:
- Use the Grant a project… dropdown and click Grant access. New grants start at the Viewer preset (read-only).
- Adjust what the group can do with the capability selector: pick a preset, or click Advanced to toggle individual capabilities.
Revoke removes the group’s access to that project entirely.
Presets and capabilities
The five presets cover the common cases:
| Preset | Capabilities |
|---|---|
| Viewer | View |
| Release manager | View, Promote & roll back |
| Developer | View, Promote & roll back, Deploy & operate, Manage web apps, Manage workers |
| Maintainer | Developer, plus Manage databases, Manage object storage, Manage secrets |
| Admin | Everything, including Manage environments and Manage project |
Under Advanced, the individual capabilities are grouped into Read (View), Operate (Promote & roll back, Deploy & operate), and Manage — separate toggles for web apps, workers, databases, object storage, secrets, environments, and the project itself. Manage project also allows managing the project’s members and project invitations. Any combination is allowed; a mix that matches no preset shows as Custom.
Some capabilities may appear disabled and marked “Reserved to platform admins” — those are held back by your platform operator and withheld from everyone in the organization, including Owners and Admins; they cannot be granted to groups.
If someone is in several groups (or also has a direct project membership), their capabilities on a project are the union of everything granted.
Per-environment overrides
By default a grant applies to every Environment in the project. To give a
group different access in one environment — for example, full Developer
access in staging but Viewer-only in production:
- In the project’s access row, click Per-environment overrides.
- Next to the environment, click Override (inheriting project default). The override starts at the Viewer preset.
- Set the capabilities for that environment.
While an override exists, it is what the group gets in that environment instead of the project-level grant. Click Reset to inherit to remove the override and fall back to the project default.
Delete a group
Click Delete next to the group and confirm. Members lose the access this group granted, and the deletion cannot be undone.
Next steps
- Access Control — how roles, groups, and capabilities fit together
- Inviting People — bring new members into the organization first
- Managing Your Organization — organization roles, members, and settings