Browse the docs
Concepts
Roles in organizations and environments
Organization roles Owner, Admin and Member, and environment roles Editor, Reader, Specific files and Operator: what each can do and what enforces it.
Last updated
On this page
Crunu has two kinds of roles. An organization role decides what someone can manage. An environment role decides what they can read or change in one environment. Most environment roles are enforced by cryptography: without the environment key, there is nothing to decrypt.
Organization roles
| Role | What it covers |
|---|---|
| Owner | Everything an admin can do, plus appointing admins and owners and managing the organization's name and settings. |
| Admin | All shared environments, through the organization recovery key, plus members, machines, tokens and the audit log. |
| Member | Only what's granted: environment roles, directly or through access profiles. |
Owners and admins hold the organization's signing key and recovery key. They aren't listed in environment access lists, because they reach every shared environment through the recovery key.
Who can do what
| Action | Who |
|---|---|
| Invite, confirm, change roles and remove members; manage access profiles | owners and admins. Anything involving admins or owners: only owners |
| Name and settings of the organization, including audit log retention; deleting it | owners only |
| Grant and remove environment access, rotate environment keys | owners and admins |
| Create, rename and delete shared projects and environments | owners and admins |
| Create machines and enrollment codes | owners and admins. An operator, for environments where they are an operator |
| Approve machines, resume and revoke machines and tokens | owners and admins |
| Service tokens and their CI bindings | owners and admins |
| Network lists and environment network rules | owners and admins. A fast rollback of a rule: owners only |
| Break-glass access | an owner opens it for themselves. An owner or admin can revoke it |
| Approve or reject access requests | owners and admins |
| Read the audit log, verify it, export it and see exposure reports | owners and admins. Members see their own events |
Some rules protect against mistakes:
- Crunu won't remove the only remaining owner.
- Nobody removes themselves. Another owner or admin removes a member, or the member deletes their own account. An owner transfers ownership first.
- A sole owner of an organization can't delete their account until they transfer ownership or delete the organization.
Environment roles
| Role | What it means | Enforced by |
|---|---|---|
| Editor | reads and edits all files in the environment | the environment key, sealed to the member |
| Reader | reads all files in the environment | the environment key, sealed to the member |
| Specific files | reads only the selected files. The sealed copy updates on save. Can't edit | a file copy sealed to the member, with only those files |
| Operator | has no environment key and can't see values. Adds machines and requests access for them | no key at all |
A developer who is an Editor on development can't read production, because they don't have its key. That holds even against a compromised server.
The Operator role suits someone who sets up servers but shouldn't see production values. An operator creates a machine for their environments and issues it an enrollment code. An owner or admin then approves the machine, and that person's app delivers the environment key or file copy to it.
Personal environments
A member's personal project is managed only by its owner. An admin can't change its access. With recovery turned on in the organization settings, owners and admins can read it through the organization recovery key.
Roles for machines and tokens
Machines and service tokens don't get roles. They get a delivery method on each environment:
- Environment key: always the latest version of all files. Revoked by rotating the environment key.
- Selected files: a sealed copy of only the selected files, updated on save. Revoked without rotating the key.
Specific files is a role for people. Selected files is a delivery method for machines. They work the same way underneath, but they are named differently so they don't get mixed up.
Changing roles
Open Members, then a member, then Role… to change their organization role, or Grant access… to change environment access. The member's page shows an Environment access matrix of projects by environments, with each cell showing the role and where it comes from: direct, via access profile or by request.
Removing someone from an environment where they had the key marks the environment as needing rotation. Demoting an owner or admin means the organization keys they knew should be replaced: the organization moves to a new key generation, which reissues certificates and rotates every shared environment. Pending actions shows what's left to do.
What roles don't cover
Roles control access to values. They can't control what someone does with a value they've already seen. Hidden values and export restrictions in the interface protect against accidents, not against a person who has the key. When someone leaves, follow Offboarding a teammate and reissue the values they saw.
There's no time limit on an environment role. To give someone temporary access, grant it and remove it when the work is done. Time limits exist for invitations, share links, service tokens, machine leases and break-glass access.