Team Management

dbtrail uses role-based access control (RBAC) to manage what each team member can do within a tenant.

Roles

Each user is assigned a role within a tenant. Roles form a hierarchy — each role inherits all permissions from the roles below it.

owner
  └── admin
        └── operator
              └── analyst
                    └── viewer

Permission matrix

Inviting team members

From the dashboard, go to Settings → Team → Invite Member:

1. Enter the user's email address
2. Select a role
3. Send the invitation

The invited user will receive an email with a link to join the tenant. If they don't have a dbtrail account, they'll be prompted to create one first.

Changing roles

Owners and admins can change a member's role from Settings → Team. Click the role dropdown next to the member's name and select the new role.

Table and column access

In addition to functional permissions, each role can have restrictions on which MySQL tables and columns they can see. See Access Rules for full details on configuring data-level access control, including:

• Hiding PII columns from analysts
• Restricting access to sensitive tables
• Compliance with data access policies

API key inheritance

When a user generates an API key, the key inherits their role. If a user's role is later downgraded, their existing API keys will operate with the new, reduced permissions.