> ## Documentation Index
> Fetch the complete documentation index at: https://docs.firedrill.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Team access and credentials

> Grant organization membership, project access, and automation authority separately.

Organization membership and project access are separate decisions. A resource ID or evidence link does not bypass either.

## Invite a teammate

An organization owner or administrator can use **Settings → Members → Invite member**. The recipient accepts the invitation to join the organization.

Then use **Settings → Project access** to grant the intended project role:

| Role    | Purpose                                              |
| ------- | ---------------------------------------------------- |
| Viewer  | Inspect permitted project resources and evidence     |
| Builder | Build and operate within the granted project actions |
| Manager | Manage project access and sensitive project controls |

Review the exact action list when assigning access. Organization membership alone does not grant access to every project.

## Create an automation credential

Use **Settings → Credentials → New credential**. Choose developer or service use, the minimum action set, project scope, and expiry.

Presets such as **Read only**, **Run drills**, and **Project automation** narrow the credential's authority. Project automation is not automatic permission to approve executable Tool artifacts.

The secret is shown once. Store it in a secret manager, not source, logs, browser-test input, or evidence. Revoke credentials that are no longer needed.

## Separate control and world access

Automation credentials operate the Control API. The evaluated agent receives only a short-lived binding for the active world and actor.

See [authentication](/api-reference/authentication) and [security](/guides/security).