# Team and access

URL: https://shellz.dev/docs/guides/team

> Invite teammates, choose roles, and see who viewed which recording.

Everyone in your org can see servers and sessions. Roles decide who can change things, and every sensitive action needs a recent sign-in.

## Roles

| Action | Owner | Admin | Member |
|---|---|---|---|
| See servers, fleets, sessions and alerts | ✓ | ✓ | ✓ |
| Watch and replay recordings | ✓ | ✓ | ✓ |
| Add servers and fleets, manage fleet tokens and policies | ✓ | ✓ | |
| Remove servers, change server policies | ✓ | ✓ | |
| Invite and remove teammates, change roles | ✓ | ✓ | |
| Configure alert destinations | ✓ | ✓ | |
| Read the audit log | ✓ | ✓ | |
| Approve teammates and rotate the org key (Perfect Secrecy) | ✓ | ✓ | |
| Turn on Perfect Secrecy | ✓ | | |

Admins can't change or remove owners. An org always has at least one owner.

## Inviting teammates

In **~/team**, under **Invite teammates**, enter an email address, choose **admin** or **member**, and click **Send invite**. The teammate gets an email from shellz, signs up with Google, GitHub or a passkey, and joins your org. Invites expire after 7 days; pending invites can be revoked from the same card.

With [Perfect Secrecy](https://shellz.dev/docs/security/perfect-secrecy.md) turned on, a new teammate also needs to set up a passkey for encryption in **~/security**, and an owner or admin approves them under **Pending access approvals** in **~/team** after comparing key fingerprints. Until then, they can see sessions but not open recordings.

## Removing teammates

Click **Remove** next to the teammate in **~/team**. They lose access immediately. With Perfect Secrecy, your browser also rotates the org key so future recordings use a key they never had. See [Removing a teammate](https://shellz.dev/docs/security/perfect-secrecy.md#removing-a-teammate).

## Recent sign-in

Viewing recordings, and actions such as removing servers, changing policies, managing teammates and fleet tokens, and approving access, require a sign-in within the last 10 minutes. If yours is older, shellz asks you to confirm with your passkey or sign-in method before continuing.

Sign-in sessions end after 7 days without use, or 30 days at most. You can see and end them in **~/security** under **Where you're signed in**.

## Audit log

Owners and admins can read the audit log in **~/audit**. It records, with the actor, time and IP address:

- every recording viewed;
- sign-ins, failed sign-ins and passkey changes;
- servers enrolled and removed, policies changed, rejected enrollments;
- fleets created, tokens rotated and revoked;
- invites, role changes and removals;
- alert destination changes;
- Perfect Secrecy setup, approvals, recovery and key rotations.