Managing team permissions

Overview

This topic explains how to add and remove permissions from teams.

If you have an Owner / Admin role, or you have the required custom role permissions, you can add and remove custom roles that grant permissions to members of the team.

How team roles interact with individual member roles

Every organization using LaunchDarkly is made up of members. Members are people who work for your organization or use your organization's LaunchDarkly account.

Organizations use roles to gain more precise control over resources such as feature flags and experiments, or over LaunchDarkly administration.

Every member must be individually assigned either one of LaunchDarkly's built-in roles or a custom role. To learn more, read Custom role concepts.

An individual member may have either a built-in role or one or more custom roles. If a member belongs to one or more teams, the member's roles will aggregate with the custom roles that are applied to their teams. For example, if a member has the built-in Writer role, the Writer access is used in addition to the access defined by the custom roles assigned to the team.

A team can have one or more custom roles assigned to it. In cases where a team's custom roles have conflicting permission levels, or a team's custom role has conflicting permission levels with the permissions assigned to a member of that team, the more permissive set of permissions will be applied. For example, if a team has one custom role that allows access to a resource, and a member of that team has another custom role that restricts access to a resource, the team member will be able to access that resource.

Add a custom role to an existing team

You can assign custom roles to a team from the Permissions tab for the team you manage.

To assign a custom role to a team:

1. Click the gear icon in the left sidenav to view Organization settings.
2. Click Teams.
3. Click on the name of the team. The team's Team members tab appears.
4. Click on the team's Permissions tab.
5. Click Assign access. The "Assign access" dialog appears.
6. Select the role you want to add to the team.
7. If the role you are assigning uses any role attributes in its definition, enter the specific Resource that this team should have for each attribute. For example, if the role attribute is for a project, enter a project key. The team will then have access to that project based on the policy statements specified in the role.

8. Click Assign access.

Remove a custom role from a team

To remove a custom role from a team:

1. Click the gear icon in the left sidenav to view Organization settings.
2. Click Teams.
3. Click on the name of the team. The team's Team members tab appears.
4. Click on the team's Permissions tab.
5. Find the role you want to remove in the list of roles.
6. Click the overflow menu at the right of the row of the role you want to remove.
7. Click Remove custom role. A confirmation dialog appears.
8. Click Remove custom role in the dialog to confirm.