Roles and grants
A workspace has an owner, admins and members. Feature access is a grant, not a role name: an admin can give a member the API studio and the accessibility auditor without giving them security scanning. This matters for security scans in particular, because the ability to run an active scan against a target is the most sensitive permission in the product.
Quotas are pooled across the workspace, not split per seat. If one engineer runs most of the security scans in a month, the rest of the team is not blocked by a per-user allowance; the workspace cap is the only cap, and the usage page shows who consumed what.
Inviting people
- Open the Team console and choose Invite.
- Enter work email addresses. Pending invitations count toward the seat limit, so an unused invite is worth revoking.
- Choose the feature grants for each person. Grants can be changed later without re-inviting.
- The invitee verifies their email and lands in the workspace. Their first sign-in is recorded in the audit log.
Sessions, passkeys and 2FA
Members can sign in with a passkey, which is the recommended method, or with email and password plus two-factor authentication. Admins can see active sessions and end them. Signing in from a second device ends the first session and tells the user why.
The audit log
Administrative and security-relevant actions are written to an integrity-attested log. Entries cannot be edited in place; a tampered entry fails verification. Export it when a reviewer asks who ran what and when.
Questions people ask about this
- Is SSO available?
- SSO and SAML are included on the Enterprise plan. On other plans, if your email domain has SSO configured we offer it during sign-up.
- Does the platform provision users automatically from our directory?
- Not today. Invitations are manual or via SSO sign-in. If you need SCIM provisioning, tell us on a demo call and we will say plainly whether and when it is planned.
Source: /documentation/team-setup-and-permissions, updated 2026-09-16. Answers are checked against the shipped product on that date.
Found something out of date? The people who build the module answer the contact form on the home page, and corrections to this guide are dated above. Tell us.