Administering an account

The role says what someone can administer. What they can read is decided by collections and keys: making someone an admin hands them no secret.

Roles

• owner — everything an admin can, plus giving and removing the owner role. An account always keeps at least one owner.
• admin — creates collections and manages people, groups and service accounts.
• auditor — reads the activity log and the diagnostic reports, and changes nothing.
• member — uses the collections they were given.

The Admin tab is visible to owners, admins and auditors.

People

Under Tenant administration → People, owners and admins change each person's role — it applies at once — or Remove them. Someone marked “no master password yet” has not created their vault, so nothing can be shared with them.

Removing someone revokes their grants and marks for rotation every entry they could open. It does not erase the copy they already have: change those passwords.

To add someone, type their email under Add someone, choose the role and press Add. Only an owner can create another owner. They appear in the list at once, and they get in through the sign-in screen with that same email.

The email has to be the one they sign in with, and the identity provider has to report it as verified. If it does not, signing in opens a separate account and this membership stays attached to the wrong row.

Groups

A group has its own keys; it is not just a list of names. Create one with New group, and add or remove people in Members. Only someone already in a group can add people to it, because only their browser holds its key.

Service accounts

A credential for a machine — a deploy, a CI job. It can read, but not write or share. Create one with a name and Create, then give it collections with Grant a collection…; until then it gets in and finds nothing. Disable turns it off.

The token is shown once, and the server never had it. Copy it at that moment: there is nowhere to look it up later.

What happened

The account's activity log: when, who, what and the result, for the latest 100 events. People, groups, service accounts and collections are shown by name. Entries are not: their names are encrypted and the server never has them, so the log names an entry only when your own vault can open it, and shows a short identifier otherwise — an auditor, who opens no secrets, sees identifiers. Details under each line has the raw action code and the rest of what was recorded. Only denials leaves the refused attempts, which is where a problem shows up before it becomes an incident. Events marked “(reported)” were reported by a browser — reveals and copies — rather than seen by the server.

History kept

Shows how many versions of each secret the account keeps, and for how long. It can only be read here; changing it is not available in the app yet.

Diagnostic reports

What people sent from the Android app when something did not work. Nothing arrives on its own. When someone reports a problem, ask them for the id the app showed after sending: that is how you find their report here.