Permissions and access control
Two layers: a workspace role, and a permission level per service.
By the OneEnv team · Last updated
Layer 1: workspace role
- Owner: everything. Archive, restore and purge a workspace; transfer ownership. A workspace always keeps at least one active Owner.
- Admin: bypasses per-service checks; manages members, permissions, and reviews branches.
- Member: limited by per-service permissions.
Layer 2: per-service permission level
Levels are ordered none, view, edit, service_admin.
view: can see the service and its notifications.edit: can pull values into the service and stage edits.service_admin: can approve or reject that service's pending changes.
Resolution order: Owner or Admin first, then the exact grant for that member and service, then the member's All services (default) grant, then none. Set these on a member's permissions page.
Read visibility
A Member only sees services where they have at least view. This filters the service list, service pages, notifications, dependency graph, search and reports. Branch review notifications are not tied to one service and are visible to every member.
What is not gated per service
Database structure writes (creating databases, tables, columns) need workspace membership, not a per-service grant, because a column has no scoped data. Approving the resulting impact still needs service_admin on the affected service.
Common errors
SERVICE_ACCESS_DENIED: you lack view on that service.LAST_OWNER: you tried to remove the only active Owner.