Teams and grants

Organize users into teams, understand who can reach what, and share read or query access with grants.

Teams are how Vigilfield decides who can reach which data. Grants let one team share read or query access with another.

Only admins can create, change or delete teams and grants.

How access works

A user can perform an action on a resource if any of these is true:

One of their teams owns the resource. The owning team can do everything with it.
Their role allows it. The owner can do everything. Every user can read the organization's tables. Admins also manage the organization's settings, but they reach data through their teams, like anyone else.
A grant to one of their teams covers it.

Access comes from all of a user's teams together. The acting team a user picks on their profile does not narrow it.

Result tables are stricter. Only the owning team, admins and teams with a grant can read one.

To see who can reach a table, rule, investigation or folder, open it and look at Who can access this. It lists the teams that own the resource or hold a grant on it, and what each can do. The owner has access in addition to the teams listed. Only admins can load this panel.

Teams

Built-in teams

Team	What it is
Everyone	Every new user joins it unless you choose other teams. A user whose last team is removed goes back into it. You can rename it and add members, but you cannot delete it.
Vigilfield	Managed by Vigilfield. It has no members and cannot be edited or deleted.

Teams created by your identity provider over SCIM show Managed by and the provider's name. You cannot rename them, change their members or delete them in Vigilfield. Make those changes in your identity provider. See Single sign-on and SCIM.

Create a team

Go to Administration → Teams and select New Team.
Enter a Team Name (at least 2 characters) and, if you like, a Description.
Select Create Team.

Add and remove members

Open the team and select Add Member.
In Add Team Member, pick a user under Select User and select Add Member.

To remove someone, use the remove action next to their name and confirm.

You can also change a user's teams from their Edit User form. See Users and invitations.

Delete a team

Select Delete Team and confirm. Members are not deleted. They lose this team, and anyone left with no team goes back into Everyone. Grants held by the team are revoked.

Deleting a team does not delete or move the resources it owns. Move them to another team before you delete it.

Grants

A grant shares access to a resource with a team that does not own it. Grants can only give read, or query on tables. They never give write, export or admin rights, and nobody can grant more, not even the owner.

A grant targets either one resource, by its ID, or every resource of that type ("org-wide").

Create a grant

Go to Administration → Grants.
In the form, choose:
- Team: who receives the access.
- Resource: the kind of resource, for example tables, rules or investigations.
- Action: read, or query when the resource is tables.
- Either tick Org-wide (every … resource), or enter one Resource ID.
Select Create grant.

A query grant also allows reading.

Vigilfield does not check that a Resource ID exists. A mistyped ID creates a grant that matches nothing. Copy the ID from the resource itself.

Revoke a grant

Select the delete icon next to a grant, then Revoke in Revoke Grant. The team loses that access immediately.

A user's page also lists, under Access Grants, the grants they get through their teams.