Workspaces & RBAC

NineDeploy organizes projects, services, databases, volumes, and credentials into isolated workspaces. Team members can belong to multiple workspaces with distinct roles.

Roles & Privileges

• Owner: Workspace administration, deletion and ownership transfer. Host privileges require the separate instance-operator flag.
• Admin: Create/edit/delete services, manage secrets, configure alert rules, invite and manage members.
• Member: Create services, edit build configuration and environment, manage domains, deploy, roll back and restart.
• Viewer: Read-only access to service statuses, build logs, and topology views without mutation rights.

Team Invitations

Workspace admins can raise a user's role for a project, an environment or their intersection. Guests without a workspace seat can access matching resources but cannot create services or databases. Grants never lower existing access or make someone an instance operator.

Invite team members via email with role assignment. When SMTP is configured, an invitation link is dispatched automatically; otherwise, admins can copy the single-use token from the dashboard.