Skip to content

How it works

Team and access (IAM): give an employee access

The person who signed up with Devora Cloud is the organization owner and has full access: projects, billing, firewall, invitations and deletion. Nothing starts locked for the registrant. In Team you invite authorized people and create user rules (IAM): Admin, Developer, Viewer or custom roles, per project and with an expiry. Inviting someone does not take access away from the owner.

Every check happens on Devora’s server: hiding a button is not what protects you; the action is refused even if someone calls the API directly.

  1. Before opening a ticket

    To grant or revoke access, open Security → Team and access. Invite the email, choose the role and, if you want, limit it to projects and a date. Do not open a ticket asking to “unlock a user”: the owner does that in the dashboard.

  2. Built-in roles

    Owner has everything, including billing and deleting the organization. Admin manages team, domains, databases and keys. Developer deploys and changes variables and settings. Viewer only reads.

  3. Custom role

    Create a role with permissions ticked one by one, for example "Shop support" with View projects and Deploy and restart. Anything not ticked is refused. Billing, API keys, team and organization deletion never go into a custom role.

  4. Only some projects

    When inviting or editing a member, choose the projects they can reach. They only see those projects in lists and get 403 on any other. Organization-wide areas (global logs, usage, audit log) stay closed to limited access.

  5. Temporary access

    Set an expiry date for freelancers and contractors. After it, the person loses access on their own, without you having to remember to remove them.

  6. Audit log

    Invitations, role changes, custom roles created or changed and removals are recorded in the Audit log with who, when and from which IP.

  • The person needs a Devora account with the invited email.
  • The registrant (owner) has full access from the first login. Everything starts unlocked; restrictions for authorized people are optional and set by you.
  • The owner always has full access: an Owner cannot be limited by project or date.
  • Nobody changes their own access, and an Admin cannot change another Admin or the Owner.
  • A custom role can only be deleted when it has no members; move them first.
Team and access (IAM): give an employee access · Devora Cloud