Teams

A team is a group of members with shared permissions and access to shared resources. Teams are how you scale access control past the first few people in an org: instead of granting permissions per-member, you put people on the right teams and let team-level roles do the work.

What teams are for

Teams play three roles in LakeSail:

1. A group of people. Members are added to teams; the team becomes the unit of "who is on this project."
2. A unit of permission. Each member gets a team role per team they're on, which grants specific permissions for resources assigned to that team.
3. A unit of resource access. Jobs, queries, catalogs, and other resources are assigned to teams. Members can use those resources according to their team roles.

A member can belong to any number of teams, and a resource can be assigned to one or more teams.

Why teams instead of just roles

Two benefits:

• Grouping. Resource forms can show the teams and members responsible for the work.
• Scoped roles. A member can have different team roles in different teams when their organization role does not already grant the same permission.
• Audit and review. To review access to a team resource, check the team's members and roles, plus organization roles with broader technical access, such as Owner and Member.

Team roles are additive. They do not restrict access already granted by an organization role. See Roles & permissions.

Create a team

1. Open Settings → Teams and click Create team.
2. Enter a Name, such as data-eng or analytics-readonly.
3. Select the Default role assigned to new members.
4. Add members now, or leave the team empty and add them later.
5. Click Save.

Owners are added to every team automatically with the Team Admin role.

Add and remove members

1. Open the team detail page.
2. Click into Members and use Add member.
3. Pick the member and pick their team role for this team. The same person can hold different team roles on different teams, such as Team Admin on one and Viewer on another.
4. To remove, click the member's row and select Remove from team. They keep their org membership and any other team memberships; only this team's permissions go away.

Auto-membership via org roles

Some organization roles set allTeams: true. Members holding those roles are automatically added to every team in the organization, with no manual step. Owner uses this setting, so Owners can manage every team's resources without repeated assignments.

You can see whether a role auto-joins teams from Settings → Roles. See Roles & permissions for which roles do this.

Assign a resource to a team

Resource forms include a Team or Teams field.

• Add a team to grant team-based access according to each member's role.
• Remove a team to remove that path to access. An organization role may still grant access.

When a form allows one team, changing the Team field replaces that assignment.

Delete a team

1. Open the team and click Delete.
2. Confirm.

You cannot delete the organization's default team or a team containing members who belong to no other team. Move those members and change the default team first. Reassign resources before deleting the team if they should remain available through team roles.

Common team patterns

• Functional teams: data-eng, analytics, ml, platform. Resource access follows each function.
• Project teams: project-launchpad, project-redesign. Time-bounded; tear them down when the project ends.
• Environment teams: prod-writers, prod-readers. A small set of high-privilege members on prod-writers; a wider audience on prod-readers. Resources in production share with both at different access levels.
• A single all-hands team: for very small orgs, one team that everyone joins. Skip the structure until it pays for itself.

API reference

• Teams: CreateTeam, team membership, and UpdateTeamMemberRoles for assigning team roles.