Teams & Access Control
FyVault uses role-based access control at two levels: organization and secret.
RBAC Model
Organization Roles
| Role | Capabilities |
|---|---|
| Owner | Full control. Delete org, manage billing, transfer ownership |
| Admin | Manage secrets, devices, teams, members. Cannot delete org |
| Member | View secrets and devices. Cannot create or modify |
| Viewer | Read-only access to all resources |
Secret Access Levels
| Level | Capabilities |
|---|---|
| Read | View secret metadata (not the value) |
| Write | Update secret values, manage versions |
| Admin | Full control: delete, manage access, assign to devices |
How It Works
- 1Create teams (e.g. "Backend", "DevOps", "Data Science")
- 2Add organization members to teams
- 3Grant teams access to specific secrets with a permission level
- 4Members inherit access from all their teams
Tip: Use teams to model your organizational structure. When an engineer moves from the Backend team to DevOps, simply update their team membership. Their access automatically adjusts.