Roles

Role	Can
owner	Everything an admin can, plus delete the project. Exactly one per project — whoever created it
admin	Invite and remove members, change roles, manage grants, read the audit log
member	Nothing administrative. Only what their grants allow

A role is not access

The most important thing on this page: no role grants access to any secret.

An admin can invite people, remove them, and manage everyone’s grants. An admin with no grant on production still cannot read production.

They can grant it to themselves — that is what administrative power means — but doing so writes a grant.create row in the audit log with their name and the time on it. The difference between an admin and a member here is not whether they can reach production; it is whether reaching it leaves a record.

That is the honest framing. A system where admins couldn’t self-grant would need someone above them, and eventually you have built an IAM platform. Instead: least privilege by default, self-service escalation, and an audit trail that makes escalation visible.

Pending members

Between accepting an invitation and being confirmed, a member is pending — shown in amber, because it needs attention.

Pending is a real state. No environment key has been wrapped to them, so they can read nothing regardless of role. They become active only after you have verified their fingerprint.

Changing a role

Admins can promote or demote. Two things it does not do:

• It does not change grants. Demoting an admin to member leaves their environment access exactly as it was. If you want to remove access, remove the grant.
• It does not transfer ownership. There is one owner and the role cannot be reassigned in the current version.

Removing someone

Removing a member deletes their grants and shows you which environments they had, with a rotation recommendation.

Take it. See rotation — and rotate the underlying credentials at your providers too, which is the half Cendarum cannot do for you.

The audit log

Admins and owners can read the project’s audit log, including every read of every environment. Members cannot.

That is the asymmetry that makes the role useful: not privileged access to secrets, but privileged visibility into who has been reaching them.