Browse documentation

Teams & roles

Group members into teams and control what they can do with roles (RBAC).

Access in a workspace is shaped by two things under Workspace in Settings: Teams group people who work together, and Roles grant the permissions those people have. A team carries a role, and the role decides what its members can do. Together they are SPARK's role-based access control. For adding people in the first place, see Members.

Teams

A team groups people who work together and gives them a role in one move. Every member belongs to at least one team, and one team is marked as the default: it cannot be deleted.

The Teams list

Open Settings, then Teams under Workspace, to see every team in the workspace. The page is titled Teams with the note Manage your workspace teams, and the search button beside New filters the list. Each row shows:

  • Name, with a colour dot so teams are easy to tell apart at a glance. The default team carries a Default badge.
  • Description.
  • Members, the faces of the people on the team, with a +N for the rest, or No members when the team is empty.
  • Roles, the role the team carries.

Click a row to open the team.

TeamsManage your workspace teamsNewNameDescriptionMembersRolesDefaultDefaultDefault team for thisworkspace.CMTB+17AdministratorNAV OversightDaily NAV checks.TBEditor
The Teams list: each team with its description, members and role.

Create a team

  1. Click New to open the New team dialog.
  2. Fill in the fields:
    • Name and Description.
    • Identifier, a short code of up to 3 letters that stands in for the team in compact places.
    • Color, picked from the colour selector.
    • Members, chosen from the workspace's people.
    • Roles, the role the team will carry.
  3. Click Create.

A team must have a name, description, identifier, colour, and a role before you can create it. Although the field is labelled Roles, a team carries a single role in practice: choosing another replaces the current one. The Identifier takes up to 3 characters and shows them in capitals, and Color starts on Primary.

CancelCreateNew teamCreate a team with a name, identifier, color,members and a roleNameDescriptionIdentifierColorPrimaryMembersNo members selectedRolesNo roles selected
The New team dialog: name, identifier, color, members and the team's role.

Edit a team

Open a team to edit it. The page is headed with the team's name and description, and has three tabs: Display, Members, and Roles.

The Display tab holds the team's Name, Description, Identifier, and Color. These fields don't save on their own: as soon as you change one, a You have unsaved changes bar appears. Click Save changes to commit, or Discard to roll the edits back.

Add and remove members

The Members tab is where you change who belongs to the team. Membership changes here save immediately, separately from the Display fields.

  • Add members: click Add to open the Add members dialog. It lists everyone not already on the team, with a Search members box; tick one or more, then click Add.
  • Remove a member: use the remove control on a member's row. A Remove member? dialog confirms first.

One rule is enforced on removal: a person must always belong to at least one team, so SPARK blocks the removal with You can't remove this member if it would leave someone with no team. SPARK's own account can't be removed either.

Assign a role to a team

The Roles tab lists every role in the workspace as a set of radio buttons, with a search box, and the role the team currently carries is marked Assigned. Pick a different role and click Assign role to switch to it. Because a team holds a single role, assigning a new one replaces the old, so this is also how you change what the whole team can do.

DefaultDefault team for this workspace.DisplayMembersRolesSearch rolesViewerEditorAdministratorAssignedAssign role
The team's Roles tab: pick a role and click Assign role. The current role is marked Assigned.

Delete a team

Use the ⋯ menu on a team's row (or right-click it) and choose Delete; a confirmation dialog follows, and deletion cannot be undone. The default team cannot be deleted: its Delete is greyed out and says why. The same menu's Edit team opens the team. To rename a team, edit its Name on the Display tab.

Roles

A role is a named bundle of permissions with its own colour. You grant a role to a team (on the team's Roles tab), and everyone on that team inherits its permissions.

The Roles list

Open Settings, then Roles under Workspace. The page is titled Roles with the note Use roles to group your workspace members and assign permissions, and the search button filters the list. Each row shows the role's Name (with its colour dot) and Description. Click a row to open the role. Where you may manage roles, a row's ⋯ offers Edit role, Open in new tab and Delete.

Create a role

  1. Click New to open the New role dialog.
  2. Set a Name, a Description, and a Color.
  3. Click Create.

All three fields are required. Where creating roles isn't enabled for your workspace, New is disabled.

Edit a role

Open a role to edit it. The page is headed with the role's name and description, and has two tabs: Display and Permissions.

The Display tab holds the role's Name, Description, and Color. As with teams, edits here save through the You have unsaved changes bar (Save changes or Discard).

Permissions

The Permissions tab shows what a role can do. Permissions are grouped by the resource they apply to, such as Agents, Threads, Channels, Canvases, Data objects, Files, Integrations, Spaces, Tasks, Workflows, External sharing or User management, and each group is a collapsible section you expand to see what's inside. A Search permissions box at the top jumps straight to a capability by name.

Each permission is a single row: the action (View, Create, Edit or Delete), a one-line description of what it allows, and a switch on the right showing whether the role has it.

Changing a role's permissions, its colour, or deleting it is reserved to NGT, so for most administrators the switches on the Permissions tab are shown but disabled, and a role's ⋯ menu is not shown. To change what a role allows, contact support. To change what a group of people can do, assign their team a different role.

ViewerBase Viewer role, able to view everything but edit nothing.DisplayPermissionsSearch permissionsAgentsCreateCan create new AgentsDeleteCan delete Agents permanentlyViewCan view and open AgentsEditCan edit and make changes to existing AgentsThreadsAnalyticsCanvasesChannels
The Permissions tab: capabilities grouped by resource, each with its own switch.

Keeping someone in charge

SPARK stops anyone from locking everyone out. If deleting a role, turning off a permission, or changing a role would leave the workspace with no role able to create roles, the change is refused with a message saying so. Keep an administrator role intact and this never gets in your way.

How teams and roles fit together

The two pieces have distinct jobs, and keeping them straight makes access easy to reason about:

  • A role answers what can be done: it is a reusable bundle of permissions.
  • A team answers who works together and which role they carry: add people to a team, assign the team a role, and every member inherits it.

So you use a handful of roles for the kinds of access you need (say, a broad administrator role and a narrower analyst role), then use teams to place people under the right one. To change what a group can do, reassign its team's role; to move a person's access, move them to a different team.

Where to go next