Runbook: roles & access

Access in Surfil is least-privilege by default. Your organization has three roles, and role changes apply immediately. This runbook covers who can do what and how to change it.

The roles

• Owner - full control of the organization, including billing and every member.
• Admin - manage members and roles; cannot change their own row.
• Member - uses products; no member management.

Change a role

On the Teamscreen, owners and admins can change any other member's role or remove them. Open a member's detail page for the same controls plus their status. You can never change or remove your own row - that prevents an admin locking the org out by mistake.

Least-privilege in practice

Grant Member by default and promote only when someone needs to manage the team. Because roles are enforced by database row-level security, not by app code, a UI bug can't widen access beyond the role - the policy is the boundary.