Access & secrets
Grant the lowest role that still lets someone do their job.
Workspace roles (reminder)
| Role | Manage members | Manage environments | Product write |
|---|---|---|---|
| viewer | — | — | read |
| member | — | usually — | yes |
| admin | yes | yes | yes |
| owner | yes | yes | yes |
Sealed secrets
Environment Secret variables are encrypted for storage:
- Plaintext is only available when you type or paste the value.
- After save, UI shows masked placeholders.
- Runners with permission read resolved values at execution time — protect CI logs.
Never paste secrets into Capture inboxes or Performance reports you share externally.
Workspace restriction on API tokens
When minting a token under Account → API tokens, enable Restrict token to … so a leaked CI token cannot touch other workspaces. See Account security.
Combine with:
spanline auth workspace use <workspace>
or SPANLINE_WORKSPACE in CI.
Leaving a workspace
Org admins can revoke workspace access from Members. Users lose product data visibility immediately for that workspace.