Team and roles

Roles

A workspace has three roles. The person who created the workspace is its first owner. Roles are per workspace: the same account can be an owner in one workspace and a member in another.

Owner and admin have the same permissions today. The difference is protection: a workspace must always keep at least one owner. You cannot demote or remove the last owner, and you cannot remove yourself. Invitations are sent as admin or member, never owner; an existing owner promotes someone to owner from the Team tab.

Where a member hits a limit, the API says so in plain words, for example “Only an owner or admin can run a free-text command. Ask an admin, or use a quick action instead.”

Inviting people

1. 1.Open Account → Team. Only owners and admins see the invite form.
2. 2.Enter an email address and pick Admin or Member.
3. 3.If that email already has an Opservo account, it is added to the workspace immediately and emailed a notice. Otherwise an invitation email goes out with a sign-up link.
4. 4.Invitation links expire after 7 days. Pending invites are listed on the Team tab and can be revoked.
5. 5.The invitee opens the link, sets a password and lands in your workspace with the role you chose.

Removing someone drops their membership in this workspace only. Their account is deleted only if this was their last workspace. Every invite, role change and removal is written to the audit log.

Two-factor authentication

Any user can turn on 2FA from Account → Security. Scan the QR code with an authenticator app (time-based codes), confirm with one code, and save the 8 one-time recovery codes shown once. At sign-in you enter a code or a recovery code; each recovery code works once. Turning 2FA off needs the account password.

Owners and admins can switch on Require two-factor authentication for the whole workspace. Every member is then taken to 2FA setup at their next sign-in before they can use the app.

Sign-in is also protected on its own: five wrong passwords lock the account for 15 minutes, a sign-in from a new location is emailed to you with the IP, device and time, and Sign out all other devices on the Security tab ends every other session at once. Changing your password does the same.

Step-up confirmation before server actions

The security policy Require a 2FA code before server actions adds a second check right before the actions that can change a server: running a free-text command, enabling remote actions, letting AI run commands, starting a fleet run, or granting or revoking SSH access. The dashboard asks you to confirm your identity, with your authenticator code if you have 2FA, otherwise your password. The confirmation is good for 5 minutes, after which you are asked again.

This policy is set by an owner or admin on Account → Security and applies to everyone in the workspace. A hijacked browser session cannot touch servers without it. Step-up is a Growth-and-above feature.

Several workspaces

Each workspace is fully separate: its own servers, plan, billing, channels and members. If you belong to more than one, a Switch workspace menu appears in the top navigation. Switching gives you a fresh session scoped to that workspace and reloads the dashboard. Signing up again creates a new workspace with you as owner; being invited adds an existing account to another workspace.