Skip to content

Administer Roles and Containment

Purpose

Grant the minimum management authority and contain API or application work at its actual owner boundary.

Prerequisites

The applicable Organization/Team management permission. Custom roles must use the bounded permission registry; ownership recovery is protected.

Procedure

  1. Choose the explicit Organization or Team scope and inspect current role assignments and membership sources.
  2. Assign a preset or bounded custom role. Separate metadata, sensitive content, export and budget administration.
  3. For API access, edit the Team allowance and exact virtual-key policy separately from human roles.
  4. Contain a credential by rotation, reversible block or terminal revocation. Contain a service or Team through its status. Pause a Production deployment or narrow its current channels/audience/API owner grants to stop new application work.
  5. Review audit and canonical Requests to verify the next operation is denied. Retain financial and historical evidence.

Expected result

Containment rechecks live authority. Key policy, status and namespace use independent revision counters. Current deployment access can be narrowed even when a newer unpublished snapshot has different requirements. Private history is not silently reassigned or erased.

Verification

Confirm denied direct API and managed invocations as appropriate. Check that a user without sensitive-content permission cannot read captured text, even when they can inspect Team metadata or export metadata.

Failure recovery

On conflict refresh only the resource/subresource revision being edited. Terminal revoked identities need replacement. For a stale API owner remove the exact old grant; do not substitute a new membership. Changes need no gateway restart.