[ Administration ]

Team and permissions

Invite colleagues, organize them into groups and decide exactly what each person can see and change.

Overview

The Team page under Manage > Team is where you manage who has access to your PENOPS workspace and what they can do. It has two tabs: All members for people and their invitations, and Groups for sets of members who share the same permissions.

Access is granted with permission policies. A policy is a set of permissions on one scope, such as all organizations, one organization or one engagement. You can give a policy to a member directly, or to a group so every member of the group holds it.

Member status	Meaning
Active	The person has accepted and can sign in.
Pending	Invited, but the invitation has not been accepted yet.
Expired	The invitation lapsed before it was accepted.

Each member also shows a provider, the directory they sign in through: PENOPS, Google, Microsoft Entra ID or Okta.

Invite members

Go to Manage > Team and open All members.
Click Invite members.
Under Add email addresses, type or paste the addresses. Separate them with a comma, semicolon, Enter or a new line. You can invite up to 25 addresses per send.
Under Add permission policies, click Add permission policy. Pick a scope, choose what it Applies to, tick the levels you want and click Create policy. Repeat for each policy.
Click Invite members.

Invitations expire after 7 days. The policies you attach take effect when the person accepts. Every invitation creates a member; you can promote someone to owner after they join.

Email not delivered

If PENOPS could not send the email for an address, you see "The invitation stands, but the email could not be sent". The invitation is still valid, so you can use Resend invite later.

Pending invitations

Open the row menu of a pending or expired invitation to Resend invite or Revoke invitation. Resending an expired invitation refreshes it.

Manage members and owners

Open a member's row menu to choose View & Edit permission policies, Promote to owner or Demote to member, or Remove member. The member detail view has a Permission policies tab and a Groups tab.

Each policy shows its Scope, what it Applies to, its Roles and who it was Granted by. A policy inherited from a group names the group under Granted by; edit it on the group, not on the member.
On the Groups tab, use Unassign member from group to take the member out of a group.
Removing a member also removes their permissions, their group memberships and their sign-in to the workspace.

Owners

Owners pass every permission check in the workspace. The person who completes sign-up becomes the first owner.

Only owners see Promote to owner and Demote to member.
Only an owner can remove another owner.
The workspace must always keep at least one owner. To remove or demote the last owner, promote another member first.

Use groups

Groups let you assign permissions to multiple members at once. Members of a group hold all of the group's policies.

Go to Manage > Team > Groups and click Create a group.
Enter a name (for example DevTeam, up to 120 characters) and create the group.
Open the group. On Group members, click Add to group to add people.
On Permission policies, add the policies the group should hold. Use Edit policy or Delete policy to change them later.

To rename or delete a group, open its Settings tab. Deleting a group cannot be undone, and its members lose every permission the group granted them.

Permission levels and scopes

Each permission has up to three levels: Read, Write and Delete, shown in short as R, W and D. Each level includes the ones below it, so Delete includes Write and Write includes Read.

A policy's scope is either All organizations or one named organization, and it applies to All engagements or one named engagement. A grant on All organizations also covers organizations and engagements created later. The policy editor only offers the permissions that can be granted at the scope you chose.

Section	Permissions	Levels	Can be granted on
Operations	Risk Treatment, Remediation Delivery, Validate Fix, Risk Register, Assignment	R / W	All organizations, an organization or an engagement
Operations	Dashboards	R / W	All organizations or an organization
Engagements	Web App, Cloud, LLM, Secret	R / W / D	An organization
Pentest	Targets, Exposure	R / W	All organizations, an organization or an engagement
Intelligence	Surface Intelligence, Threat Intel	R / W	All organizations or an organization
Platform	Team, Orgs, Integrations (R / W / D); Billing, Workflow Policy (R / W)	As listed	All organizations only

The Engagements permissions decide which kinds of engagement a person can manage, including their schedules and runs. See Create an engagement.

Permissions for the Team page

To	You need
Open the Team page	Platform > Team: Read
Invite, resend or revoke invitations, edit policies, edit groups	Platform > Team: Write
Remove a member or delete a group	Platform > Team: Delete
Promote or demote an owner	Be an owner

Platform > Team: Write is powerful

Anyone with Platform > Team: Write can grant permissions, including to themselves. Give it only to people you would trust with full control of the workspace.

Good to know

Without Platform > Team: Write, the page is read-only and says "You can read this team but not change it."
"That email is already an active member of this tenant": the person is already on your team.
"That email is already in use on another workspace": a person can belong to only one workspace.
"An invitation for that email is already pending - revoke it to send a new one": revoke the open invitation, then invite again.
Re-inviting someone with no policies clears the policies their earlier invitation carried.
A grant on a single engagement lets the person see that engagement's organization in the organization switcher, but nothing else in it.