People and access

The People and access screen

Select Organization at the foot of the rail, then People and access. The screen has these tabs:

• People lists everyone in the organization, with their Status, Organization role, and the day they Joined. Everyone in the organization can see it. It shows names, not email addresses or phone numbers. Select a name to open the person's record.
• Invitations lists the invitations the organization has sent. Only Administrators see it.
• Agents lists every agent in the organization, with its status and the person it answers to.
• Roles lists who holds which role at each scope: the organization, each team, and each product.
• API keys opens the keys people make for their agents.

The Status menu starts at Active. Choose Deactivated for people an Administrator deactivated, Left for people who left the organization themselves, or All. A person who left or was deactivated shows No organization role.

An Administrator also sees Invite a person. Invite people walks through it.

The three roles

A role is held at a scope: the whole organization, a team, or a product. A role at the organization covers every team and product in it, a team's covers the products the team owns, and a product's covers that product alone. A person can hold several roles, and may do what any of them allows. When you invite someone, BLOM describes the roles this way:

Viewer

Reads the organization's work.

Editor

Reads and changes the organization's work.

Administrator

Manages the organization and access.

BLOM checks the role on every request, whatever a screen shows. Each role can do everything the one before it can, and more:

Seeing token use by person or agent is a permission of its own. Administrators hold it, and an Administrator grants it to any person or agent with Grant a permission on their record, and can end it there. It opens no record they can't already read.

Approving follows your PDLC, not the table. A PDLC version or a standard's revision is approved by the people its approval rule or gate check names, whatever their role, or by an Administrator. See Your PDLC and its gates and Standards. Design Lab has levels of its own, which an Administrator sets: see Design Lab levels.

Some acts are a person's alone: inviting people, granting roles, setting up agents, connecting a repository, and changing Settings. No agent can do them, whatever its role.

Changing a role, and leaving

An Administrator changes a member's roles from the person's record. Select the person on People, then Grant a role to add a role at the organization, a team, or a product, or End beside a role they hold. A change applies from the person's next request, and BLOM records who made it and why.

Deactivate a member

To end someone's membership, an Administrator selects Deactivate on the person's record and gives a reason. BLOM refuses the person's next view or change in the organization, even in a session already open, and their roles stop applying. Their record and history stay, and every record that names them keeps naming them.

BLOM then lists what still names the person, such as the tasks they own, the products they answer for, the claims they hold, and the agents they're accountable for. It reassigns none of them: change each from its own screen. A deactivated person comes back only through a new invitation.

Leave an organization

A person leaves an organization themselves:

1. Open Your profile

   Select your name, or Your profile, at the foot of the rail.

2. Choose Leave

   Under Organizations, select Leave beside the organization.

3. Confirm

   Select the button that names the organization, such as Leave Harbor Labs.

People and access then lists you as Left. An Administrator can invite you again, with any role. Your earlier roles don't come back: you hold the new invitation's.

An organization always keeps an Administrator. BLOM refuses to let its last active Administrator leave, be deactivated, or lose the role, so make someone else an Administrator first. Their role counts once they've verified their phone number.

Pending invitations

Administrators see every invitation on the Invitations tab: the Person, the Role offered, its State, who it was Invited by, and when it Expires. The State menu shows Pending invitations first. Choose Accepted, Revoked, Expired, or All for the others.

An invitation's link works once, for 7 days, and only for a person who signs in with the invited email address. BLOM emails the link to that address, and shows it to you once. An invitation also works only while the Administrator who created it is still an Administrator of the organization.

To stop a pending invitation:

1. Select Revoke

   On the Invitations tab, select Revoke on the invitation's row.

2. Give a reason

   Enter a Reason. BLOM records it with the change.

3. Revoke it

   Select Revoke invitation. The link stops working at once.

An email address has one pending invitation at a time. To replace a lost link, revoke the invitation and invite the person again.

Agents answer to a person

Every agent answers to one person, its accountable owner: the person who made its key, or the person an Administrator named when setting it up. BLOM records the agent's work under its name with that person's beside it, such as Claude · Ada Lovelace.

• A key can't have more access than you have where it reaches. A Viewer's keys read, and change nothing.
• What an agent may reach is the least of its roles, its delegation, and its accountable owner's own access, scope by scope. It never reaches past its person.
• An agent's roles, like a person's, are held at the organization, a team, or a product.
• When a person leaves an organization or is deactivated, their agents there stop acting.

The API keys tab lists your keys. Agent keys covers making, rolling, and revoking them.

Related