Working as a team without shared passwords

A login pasted into a chat has no owner and no end. It stays in that history, on both machines and in their backups.

It also cannot be taken back. The only revocation left is a password change, which locks everybody out at once and tells the platform the account changed hands.

Each person signs up for an account of their own, and an invite puts it into your workspace. From that moment the plan they work under is yours.

Profile quota, the proxy library, groups and the history all resolve against the owner. One team works inside one paid allowance and one bill.

Their own workspace stays theirs: they pick a workspace in the app's corner menu or the dashboard's Workspace row, and each has its own profiles and plan.

A role is a rank rather than a list of ticks. Every action on the server names the lowest rank it accepts, so a role the server does not recognise opens nothing. The owner can require everyone to turn on two-step sign-in: a member without it sees only the setup screen, and the team's profiles do not start for them.

A role applies to the whole workspace, so it cannot say that a contractor works on one client. Groups say that: on the Members screen press Groups next to the person, tick the groups they may see, and their list narrows to those groups.

The rule is read twice, when the list is built and when a profile is opened by its own identifier. A profile outside the allowed groups answers as if it had never existed.

• An empty choice

  reads as no restriction, so unticking the last group widens the view, and the window says so: "Nothing picked: this person sees every group"

• A profile in no group

  stays hidden once a restriction is set, or filing nothing would bypass the rule

• The restriction itself

  belongs to your workspace and does not follow the person into their next one

You tick colleagues under Share with the team in the profile menu and give each a level: can start, can edit or full access. It appears in their list marked shared with you, and unticking a name revokes access.

The fingerprint and the settings travel with the profile, so a colleague opens the same identity, not a copy; hand-picked fingerprint values and a chosen browser version stay where they were set. Cookies and logins travel through session sync where that is on (Sync sessions on the Engine screen).

One window holds a profile at a time. The second machine is told which one took it, and the hold lapses on its own when a machine goes quiet.

The proxy library belongs to the workspace, not to one computer, so everyone in it shares one. Attaching an address to a profile is how a colleague gets a way out.

The ordinary list carries the address, the label and a flag that a password is set, but not the password; pulling the whole library with its passwords belongs to a manager and above.

Where a password rests on disk, the system seals it on Windows only: on macOS the key ships inside the program, and on Linux the value is written as typed.

Every action worth arguing about writes one row: who, what and when. A password handed out of the library is one such row.

Names are frozen as they stood that day, so renaming a profile today does not rewrite last week. The History screen is read by the owner and an admin.

Removal and leaving on your own run one path, because two paths to one event eventually disagree and one of them forgets to revoke something.

All of it happens in one step, and that is the point of this lesson: access ends in one place instead of being remembered from a chat.

• Access ends both ways

  their reach into your profiles goes, and anyone's reach into the profiles leaving with them

• Their hold is released

  an open profile would otherwise look occupied to everyone who stayed

• Work profiles stay

  profiles made after they joined were created in your quota and stay with the workspace

• Library addresses stay

  a profile that walks out loses the workspace address behind it, and keeps their own

• Unused invites are burned

  an unaccepted code to the same address would be a key back in