Organizations, groups, and access

Share pipelines without sharing data or administrative authority indiscriminately.

An organization is the account and team boundary. It owns workspaces, members, and groups. Pipelines and every version, task, checkpoint, and session beneath them inherit pipeline access. Spaces and connections are independent resources, so sharing a pipeline does not silently share its row data or external credentials.

Workflow

1. Every person creates and confirms their own Relifold account.
2. An owner adds the person's email to the organization.
3. The owner optionally creates groups and adds members.
4. The owner grants a member or group the required pipeline, Space, or connection permissions.

Permissions

Permissions distinguish viewing definitions, viewing data, editing, declaring, running, deploying, curating, and managing data or connections. Grant the narrowest set needed for the person's role.

• Pipeline: view definition/data, edit, declare, run, deploy, or curate.
• Space: view data, manage data, or curate.
• Connection: use or manage the connection.
• Workspace: a permission inherited by matching resources in that workspace.

Owners and admins manage organization membership and organization-local groups. They may delegate manage_access on a workspace to a member. That member can then inspect, create, and revoke resource grants in that workspace using the active organization roster, but cannot see invited or disabled accounts, change organization membership, roles, groups, or grants in another workspace.

membership = account.set_organization_member(
    organization_id,
    email="researcher@example.com",
    role="member",
)["membership"]

group = account.create_group(
    organization_id,
    name="Researchers",
)["group"]

account.add_group_member(
    organization_id,
    group["group_id"],
    membership["user_id"],
)

grant = account.grant(
    organization_id=organization_id,
    workspace_id=workspace_id,
    principal_type="group",
    principal_id=group["group_id"],
    resource_type="space",
    resource_id="customer-feedback",
    permission="view_data",
)["grant"]

# Revocation is immediate and does not modify the pipeline or Space.
account.revoke_grant(
    organization_id=organization_id,
    workspace_id=workspace_id,
    grant_id=grant["grant_id"],
)