Teams & Roles
Teams let several people share a Nanokit workspace with role-based access control
(RBAC). You manage everything from Account → Team & Roles, or from the
terminal with nkapp team.
Creating and owning a team requires a Teams account. If you’re on a personal account, the Team view shows an Upgrade to Teams prompt that takes you to Billing. You can still be invited to someone else’s team on a personal account. See Account types.
Roles & permissions
Every member has exactly one role per team. Permissions are cumulative from Viewer up to Owner.
| Capability | Owner | Admin | Deployer | Viewer |
|---|---|---|---|---|
| View projects / resources / logs / metrics | ✅ | ✅ | ✅ | ✅ |
| Deploy / run / restart / stop | ✅ | ✅ | ✅ | — |
| Destroy / clean infrastructure | ✅ | ✅ | — | — |
| Manage env vars / secrets | ✅ | ✅ | — | — |
| Invite / remove members, change roles | ✅ | ✅ | — | — |
| Manage billing / plan / seats | ✅ | — | — | — |
| Rename / delete team, transfer ownership | ✅ | — | — | — |
An Admin can only assign roles up to their own level — they can never grant or change the Owner role (ownership moves only via transfer ownership).
Create a team
Open the Team view
Go to Account → Team & Roles. On a Teams account with no team yet, you’ll see a guided Create your first team screen.
Name it
Pick a team name (you can rename it later). This creates the team with you as the Owner.
Invite members
Add members by email and assign each a role. They receive a branded invitation email with a secure link.
After a Teams sign-up, a short team setup wizard runs automatically to walk you through naming the team and sending the first invites; you can skip it and do it later.
Invitations
- Invites are sent by email and are bound to the invited address — the link can’t be accepted by a different account.
- Invites expire after 7 days; Owners/Admins can revoke a pending invite.
- Seat limits (from your plan) are enforced: inviting beyond your seats prompts you to add seats first.
To accept, the invitee opens the link (/?invite=<token>) in the Account app and
clicks Accept invite; they join with the role you chose.
Managing the team
From the members table, an Owner/Admin can:
- Change a member’s role (except the Owner’s).
- Remove a member (except the Owner).
- Rename the team (Owner).
- Transfer ownership to another active member (Owner).
- Delete the team (Owner) — a destructive action guarded by a confirmation dialog that requires typing the team name.
Any member can leave a team; the Owner must transfer ownership before leaving.
Deleting a team permanently removes the team, its members, and all pending invites. This cannot be undone.