Groups and roles
Granting workspace access person by person does not scale. Groups collect members and give the whole group a role in one or more workspaces. When someone joins a team, add them to the group; when they move, move them.
Roles a group can grant
| Workspace role | Can |
|---|---|
workspace_user | Use the workspace in Syntic’s apps; no keys. |
workspace_developer | Create and manage their own API keys; read usage. |
workspace_admin | Manage keys, limits and members of the workspace. |
Organization roles (owner, administrator) are never granted through groups; they stay individual decisions.
Effective permissions
A member’s role in a workspace is the highest of their own role and every group role that applies. Removing someone from a group therefore only lowers their access if nothing else grants it; List members shows the effective role.
Groups from your identity provider
If you connect SCIM, your identity provider’s groups appear here with source: scim. Their names and members are managed in the identity provider; in Syntic you only assign their workspace roles. This keeps one source of truth for who belongs where.
Manage groups
Console: Settings → Members → Groups. API: Groups.
Audit
Every group change (members, roles) is recorded in the audit feed with group.member_added, group.member_removed and group.roles_changed.