Teams
Group people into teams, give each member a team role, and grant a team the vaults it needs — and why a grant is waiting until someone who holds the vault key completes it.
Team Business Enterprise
A team is a named group of people. You create one so that you can grant access once, to the group, instead of person by person — and so that when someone joins or leaves the group, their access follows.
A team is only ever a grantee. It never owns a vault, a project or a secret; what it can reach, it reaches because a vault, project or namespace names it. Creating a team grants nobody anything.
Find it under People → Teams.
Who can open this page#
| You are | You see |
|---|---|
| Someone who can manage members | Every team in the organization, and the New team button |
| A team lead of at least one team | Only the teams you lead, and no New team button |
| Anyone else | Nothing — the entry is not in your navigation |
"Can manage members" means your role holds the member-management permission (the seeded Organization Administrator role does). A team lead's authority exists only inside their own team, which is why leads get the page but not the right to create teams. See Roles & permissions for what each team role allows.
Teams are available on the Team, Business and Enterprise plans.
The teams list#
The page lists each team by name, with its description under it. Select a row (it ends in Manage →) to open the team in a side panel. With no teams yet you see No teams yet and, if you may create them, a New team button.
Create a team#
- Go to People → Teams and select New team.
- Enter a Name. It is required and must be unique within your organization.
- Optionally add a Description (up to 500 characters) saying what the team is for. It is shown wherever the team is offered.
- Select Create team.
Then add people and grant vaults. Names can be up to 100 characters.
There is no way to delete a team from the console today. To stop a team reaching anything, remove its members and revoke its vault grants.
The team panel#
The panel header shows the team's name, its member count and how many vaults it has been granted. It has three tabs.
Members#
Each row shows the person, their email and their team role:
| Team role | What it lets them do in this team |
|---|---|
| Team Lead | Everything inside this team: manage members, grant vaults, edit the team |
| Team Contributor | Manage the team's vaults and read them |
| Team Viewer | Read the team's vaults |
Team roles apply only inside the team — being a lead of one team gives you nothing in another.
If you may manage the team's members, each row (other than your own) has a role picker and a Remove button, and a form at the bottom, Add someone, lets you pick a person and a role. Only active members of your organization can be added. Both changing a role and removing someone ask you to confirm first, because each takes access away.
Two rules protect the team from locking itself out:
- You cannot change or remove your own row. Doing so would drop the authority needed to undo it. Ask another lead.
- A team's only lead cannot be removed or demoted. Their row carries an Only lead badge. Give someone else the Team Lead role first. Other leads show a Lead badge.
Removing someone takes away their access to the team's vaults and to every project the team is a member of. A vault they could already open still needs a key rotation to be certain they can no longer read it.
Vaults#
This tab lists the vaults granted to the team, each with its access level and the date it was granted. Under Grant a vault, pick one of your vaults, choose Viewer or Editor, and select Grant. Revoke removes a grant.
Only Viewer and Editor are offered. A team grant is not sharing, and it never hands out Manager or Owner access.
A team holds no encryption key. Granting a vault to a team records that its members may have the vault, but each member can open it only once someone who already holds the vault's key re-encrypts that key for them. PulsVault's servers cannot do that step — they never see the key — so it has to happen in a browser where the vault is unlocked.
Until that happens, the tab shows a banner: N vault grant(s) are waiting for a key, with a Grant access now (N) button. Your vault must be unlocked; select the button and your browser completes the pending grants. It can only complete the ones you hold the key for, so a grant waiting on someone else stays waiting until that person does the same. The banner and button are hidden while the organization is read-only. The count is of keys, not people: one vault granted to a team of five is five keys.
The same waiting count appears on the Home page's My teams view — see the organization Home.
Settings#
Rename the team and edit its description, then select Save changes. Renaming changes nothing about who is in the team or what it can reach. Without permission to edit the team, you see the name and description read-only, with a note that editing needs the Team Lead role or an organization administrator.
When the organization is read-only#
If the organization is suspended or its subscription has lapsed into read-only, every write on this page is refused: New team, the member controls, the vault grant controls and Grant access now are hidden. You can still read teams, members and grants.
Related#
- Members — adding the people you then place in teams
- Roles & permissions — the team permissions in full
- Project access — how a team gets onto a project