Skip to content
SKE

Teams & Permissions

SKE uses a hierarchical permission model backed by OpenFGA. Permissions flow downward through the resource hierarchy, and every access check is explicit and auditable.

Organization hierarchy

Section titled “Organization hierarchy”
Organization
├── Members (users with direct org membership)
├── Teams (groups of members)
├── Roles (reusable permission sets)
└── Workspaces
    ├── Projects
    │   └── Environments
    ├── Cloud Providers
    ├── Networks, Databases, Caches
    └── Domains

Organizations

Section titled “Organizations”

Every user gets a personal organization at signup. Personal orgs are for solo use — you can create additional organizations for companies or teams.

Terminal window
ske orgs
  SLUG          NAME              PERSONAL
* acme-corp     Acme Corporation  no
  jane-doe      Jane Doe          yes
Terminal window
ske orgs switch acme-corp

Workspaces

Section titled “Workspaces”

Workspaces group related projects and infrastructure within an organization. Each org has a default workspace created automatically.

Common patterns:

  • One workspace per client — separate billing boundaries
  • One workspace per product — separate infrastructure stacks
  • One workspace per team — separate access boundaries
Terminal window
ske workspace list
ske workspace switch production

Members

Section titled “Members”

Invite members to your organization via the dashboard. Members can be assigned roles directly or added to teams.

Permission model

Section titled “Permission model”

SKE uses relationship-based access control via OpenFGA. Permissions are:

  • Hierarchical — a permission granted at the organization level propagates to all workspaces, projects, and environments within it
  • Union semantics — if a user has a permission from any source (direct grant, team membership, role assignment), the permission is active
  • Protected environments — environments marked as protected require explicit deployment permissions, even if the user has workspace-level deploy access

Permission categories

Section titled “Permission categories”
Category Examples
Organization manage settings, view audit log, manage billing
Members invite, remove, assign roles
Workspaces create, update, delete
Projects create, update, delete
Environments create, update, delete, deploy, manage secrets
Infrastructure manage databases, caches, networks, domains
Cloud Providers connect, update, delete
API Tokens create, manage

In this section

Section titled “In this section”
  • Teams — create teams and assign members
  • API Tokens — scoped tokens for CI and automation