06 Adding Users

This chapter describes how to create, update, and remove team members in SSH Teams.

6.1 Prerequisites

Requirement	Lab	Staging	Production
Signed-in account with user-management permission	Required	Required	Required
Role model documented for your team	Optional	Recommended	Required
Secure channel for credential handoff	Recommended	Required	Required
Leaver/offboarding checklist defined	Optional	Recommended	Required

6.2 User Management Permissions

The user-management UI is available under Administration -> Users.

Users list screen:

Access requirements:

• You must be signed in.
• Your account must have permission to manage users (MANAGE_USERS or ADMIN).
• Access is scoped to your own team only.

If the signed-in account does not have user-management permission, the flow redirects back to administration.

6.3 Creating Users and Assigning Roles

Open Add User from the users list.

Create-user form:

Required fields:

• Display Name
• Email
• Password (minimum 8 characters)

Optional fields:

• Phone Number

Role assignment:

• Admin
• Manage Servers
• Manage Policies
• Manage Users
• User

Notes on creation behavior:

• New users are created as email-verified accounts.
• Email addresses must be unique.
• If password length is below 8, creation is rejected.

6.4 Editing and Deleting Users Safely

Edit flow:

1. Select Edit on a user row.
2. Update profile fields.
3. Optionally set a new password (leave blank to keep current password).
4. Select Save Changes.

Delete flow:

1. Select Delete on a user row.
2. Confirm the delete prompt.

Safety controls in the UI and controller:

• You cannot delete your own account.
• You cannot change your own permissions in the edit form.
• You can only edit or delete users within your own team.

Operational caution:

• Update flow currently accepts changed email values without a duplicate-email check. Prefer changing one account at a time and validating the resulting users list after save.

6.5 Role Design Recommendations

Recommended role patterns:

• Keep one or two break-glass Admin accounts only.
• Use least privilege for day-to-day operations:
  • user onboarding/offboarding: Manage Users
  • infrastructure onboarding: Manage Servers
  • access governance: Manage Policies
• Grant User to regular team members that only need certificate/device workflows.

Example operating model:

• Platform owner: Admin
• IAM/security engineer: Manage Users + Manage Policies
• Infrastructure operator: Manage Servers
• Developer: User

6.6 User Lifecycle Runbook

Joiner:

1. Create user with minimum required roles.
2. Share sign-in details through your approved secure channel.
3. Ask the user to register at least one device.

Mover:

1. Edit user and adjust role set to match the new responsibility.
2. If needed, rotate password by setting a new value.
3. Validate that access behavior matches expected policy and server scope.

Leaver:

1. Delete user account.
2. Revoke/retire any remaining active devices tied to that person (see devices chapter).
3. Confirm no active policy grants remain for the departing identity.

Verification checklist after changes:

• Users list reflects expected profile and permissions.
• Self-account protections still apply for current admin session.
• Role assignments align with least-privilege design.

6.7 Pro Tip and Common Gotcha

Pro tip:

• Review role assignments in weekly batches instead of only during incidents. Small recurring reviews catch privilege drift early.

Common gotcha:

• Teams often remove a user account but forget device cleanup workflows. Pair user offboarding with device revocation checks.