Sharing and access
Team roles, who can run each function, and who sees which runs.
Callables decides who can run each function, and keeps each person's runs private by default.
Roles
Everyone on a team has one role:
| Role | Can |
|---|---|
| Owner | Everything, including deleting the team and managing other owners |
| Admin | Manage the team and its people, but not delete it or change owners |
| Builder | Connect repos, deploy, and manage the functions they deploy |
| Member | Run the functions shared with them |
Most people in a company are members: the people in support, ops or finance who run tools but don't write them.
Sharing a function
A newly deployed function is private. Only the builder who deployed it, and owners and admins, can run it. In the function's sharing settings, either:
- Share it with the whole team, for tools anyone can use, or
- Add people with Can run (see and run it) or Can manage (also change its sharing, and see all its runs and schedules).
Builders don't automatically see each other's functions, so a payroll tool isn't visible to every engineer who can deploy.
Who sees which runs
- Everyone sees their own runs.
- People who manage a function see all of its runs.
- Owners and admins see every run on the team.
Flows and secrets
- In a flow, people only see next actions they're allowed to run.
- People who run a function never see its secrets.
- Tracebacks are shown to builders only. People running a function see the error message.
Inviting people
Invite people by email or with an invite link, and pick their role when you invite them. On Pro, you can add a trusted email domain, so anyone with a company email address can join.