Decide who sees which profiles

The role answers what a person may do: touch billing, change the shared proxy library, work only with what they were given. It is the same answer everywhere in the workspace. The member's row on the Members screen also has a Profile limit: empty means no limit, 0 means the person cannot create profiles.

Groups answer something narrower: out of the profiles opened to this person, which ones are visible. One person can be a manager and still see two groups out of ten. The Lead in the same row, a manager or an admin, sees, starts and edits the profiles of their people within their own groups, but cannot delete or share them or set their password.

A third thing is decided on the profile itself: when the owner shares it with a colleague, they choose the access level, can start, can edit or full access.

Groups start on the Groups tab. A group is kept on this computer, and once one of its profiles goes to the account the group is created there too and means the same thing to everyone in the workspace. The program offers the controls that create and change groups to an owner or an admin.

Deleting a group here keeps its profiles but leaves the group in the account alone, and for a signed-in user that group comes back at the next app start or sign-in.

The choice belongs to the member's row, because that is where you already are when you think about it.

1. 1

   Open the Members screen

   Members in the left column, under Team.

2. 2

   Find the person

   The list of members on that tab.

3. 3

   Press Groups

   The button in that person's row.

4. 4

   Tick the groups

   The list inside the Groups window.

5. 5

   Press Save

   The button at the bottom of that window.

Ticking nothing is not the same as taking everything away. An empty list is read as no restriction, so removing the last group gives the person the ordinary view back. The window says so: «Nothing picked: this person sees every group».

The opposite reading would be a trap: the way to widen access would look exactly like the way to cut it off.

It is read when the list of profiles is built and again when a profile is opened by its own identifier, and the same check now guards its extensions. A rule read in only one of those would be decoration: the other doors would still be open.

A profile outside the allowed groups answers as if it were not there at all. A different answer would let someone count the profiles they are not allowed to see.

The owner of the workspace sees everything and cannot be restricted, and a group from somebody else's workspace cannot be granted.

The restriction belongs to the workspace rather than to the person, so it does not follow them out of the door into their next one.

Admin and Manager change what the whole team uses: a Manager edits groups, shared proxies and scenarios, an Admin also people and billing. So the app and the Dashboard give these roles only after you enter your account password again, and the 2FA code if it is on. A stolen session alone cannot hand them out.

This covers an invite, a team login, raising a role and accepting such an invite: the person accepting enters their own password. Operator and Member, lowering a role and changing a group need no password.

Each time someone becomes a Manager or an Admin, the bell of the apps where the owner is signed in shows A new admin or manager in your team. The app where the owner made the change does not show this line.

When a person of any role accepts an invite or a team login is created, the bell shows Someone joined your team or A team login was created on every device where the owner and the admins are signed in: who, which role, who added them, from which device and address, when, and in which team.

The device is the sign-in that sent the invite or created the login, named as under Where you are signed in. The address is that of the request: your device with an unknown address means someone else used your sign-in.

An invite for an operator or a member asks for no password, as with large services. So remove a person you do not know under Team at once and check the team API keys on the site, where the owner and the admins see and revoke every key.

The line comes once: removed, it does not come back. The device that created the login gets no line about it, and an older server sends none.

More than five such lines from one team at once come as one, Many people were added to your team at once, with Open the review naming each person. Security lines stay in the bell until you read them.