Limit members to certain servers and sites with teams
By default an organisation's servers and sites belong to everyone who can see them. That is fine for three people who trust each other. It is not fine for an agency with client projects, or a company where only the platform group should touch the production servers. Teams solve this: a team is a group of members, and you share servers and sites with the team. Members who belong to a team see what the team shares, and nothing else.
This article shows how to create a team, add people, share resources, and how SrvYard decides what a member sees. Roles say what a member may do, teams say where. Roles are covered in Choose and create roles for your team.
Before you begin
- A plan that includes teams. Teams and custom roles are part of the Business plan. See Plans and limits compared. Without it the page explains what is missing.
- Permission to manage teams. Seeing teams needs teams:view. Creating, renaming and deleting a team and changing its members and resources need teams:create, teams:update and teams:delete. Owners, admins and managers hold them.
- Members and resources to share. People must already be in the organisation: see Invite team members and manage who has access.
1. Create a team
Open Settings in the sidebar and choose Teams. "A team is a group of members given access to specific servers and sites. Owners and admins always see everything; other members see what their teams share, plus what they created."
- New team. Creates a team.
- A team row. The name, the number of Members, Servers and Sites it has, and an arrow that opens the team.
Press New team.
- Name. "Name it after the people or the project, for example 'Backend' or 'Client work'. You add members and resources next."
- Create team. Saves the team and takes you to its page.
2. Choose who is in the team
Open the team. At the top are the Team name with a Rename button and Delete team. Below are three cards side by side.
- Rename. Changes the name of the team after you edit it in Team name.
- Members. "People who belong to this team." Every active member of the organisation is listed with a tick box. The counter under the list ("2 selected") says how many are ticked. Press Save to apply, because each card saves on its own.
A person can belong to several teams, and they see the combined access of all of them.
3. Share servers and sites
The other two cards decide what the team can reach.
- Servers. "Servers this team can see, with every site on them." Tick a server and the team sees the server and every site on it, including sites you add later.
- Sites. "Individual sites this team can see, without their server." Use this for a client who should see their own site but not the server it shares with other clients. Each card has a search box, a counter and its own Save button.
Share a server when the team looks after the machine. Share single sites when the team only works on the application. A developer who has one site but not its server can work on that site, as far as their role allows, but cannot see the server's other sites, databases or settings.
4. How SrvYard decides what a member sees
The rules are short, and they apply everywhere in the app: lists, search and direct links.
- Owners and admins see everything, whatever teams exist.
- A member who belongs to at least one team sees: the servers shared with their teams and all sites on them, the sites shared with their teams, and the servers and sites they created themselves (with all sites on a server they created).
- A member who belongs to no team sees everything only when their role includes the permission resources:access-all. The built-in Viewer role has it. The others do not, so such a member sees only what they created.
- Anything hidden is simply absent. A link to a server or site a member cannot see answers "not found", as if it did not exist.
- Jobs and scheduled tasks are not limited. Background work, such as deployments and backups, runs for the organisation, not for a person.
Two consequences are worth remembering. Adding a Viewer to a team makes them see less, not more: they now see only what the team shares. And a member always keeps access to what they created, so a developer who creates a site on a shared server still sees it even if you later remove the share.
Teams narrow what a member can see. They never widen what a role allows. A member whose role cannot reboot servers cannot reboot a server just because the server is shared with their team.
An example
The Acme Studio organisation in these screenshots has three teams. Platform has three members and shares seven servers, so those members see the machines and every site on them, and look after them. Storefront has three members, two servers and four sites: the shop team sees the shop servers and a few extra sites. Content has two members and no server at all, only three sites: the editors see the marketing and blog sites, deploy them, and never see a server list with machines they have no business with. The owner and the admin see everything, and nobody had to be told which servers exist.
If you are starting from nothing, begin with one team per group of people who work on the same things, share servers with the teams that operate them and single sites with the teams that only build on them, and review the lists whenever a new client or server arrives.
5. Change or remove access
- Remove a person from a team: untick them in Members and press Save. They lose access to what only that team shared.
- Stop sharing a server or site: untick it and press Save.
- Delete a team: Delete team at the top of its page. The members stay in the organisation; only the grouping and the shares go.
- Offer teams when you invite: the invitation panel has a Teams list, so a new member lands in the right team at once.
Troubleshooting
- A member says they see nothing. They belong to a team that shares nothing yet, or they belong to no team and their role does not include resources:access-all. Share something with the team or add them to one.
- A member can see too much. Check whether they are an owner or admin, whether they belong to another team that shares more, and whether they created the resource themselves.
- A new server does not appear for a team. Teams only see servers you share with them (or that their members create). Tick the new server in the team's Servers card.
- I shared a site but not its server and the member cannot find their site. Check the Sites card was saved. Each card has its own Save button.
- The Teams page says teams are not available. Your plan does not include them. See Plans and limits compared.
- I deleted a team by mistake. Create it again, add the members and shares. Nothing else was deleted.
Related
- Choose and create roles for your team: what each member may do.
- Invite team members and manage who has access: add people before you put them in teams.
- Plans and limits compared: which plans include teams.
- Least privilege and auditing: a way of deciding who needs what.