Team Roles and Permissions

Every team membership has exactly one essesseff role (exclusive / XOR). That role drives app permissions, lifecycle promotion gates, and GitHub team membership synchronized by the essesseff GitHub App.

Only Account Admins (owners) and DevOps Engineers can invite members or change another member’s role. Assignment uses a single dropdown on invite and on the team Members page—not multi-select checkboxes.

Exclusive elevated and read-only roles

These roles stay single exclusive options (they cannot be combined with lifecycle facets):

1. Account Admin (owner) — Full account control, billing, and user/role management; includes all other role capabilities.
2. DevOps Engineer — Organizations, repositories, DevOps operations, and user/role management; includes all other role capabilities except Account Admin.
3. Read-Only User (member) — View-only access to account resources. Not an admin role.

Lifecycle roles

Lifecycle promotion work uses three capabilities (“facets”):

You can assign each as a singleton role, or as a named combo that grants the union of those capabilities:

Combo roles appear as separate options in the same invite / members dropdown. In the members table they show as one badge per capability (same colors as the singleton roles).

Account Admin and DevOps Engineer can also perform lifecycle actions. Read-Only cannot.

GitHub team mapping

Role changes reconcile GitHub team membership (in addition to sticky Read-Only for members as applicable):

Related

• FAQ: What roles and permissions are available in team accounts?
• How the build-once-deploy-many image lifecycle works