People and roles

Who can do what in Orbit, how accounts work, and how to add, change and remove people.

Who this is for

Everyone, to understand what their role allows, to fill in their own Profile, and to know who to ask for more.
Project Admins, to manage the people of a project.
System Admins, to manage accounts, teams and access across projects. Recovery steps and the periodic access review are in People account recovery.

Before you start

To manage people you must be a Project Admin of the project, or a System Admin. System Admins also need the authenticator (the code app) verified in the current session.
Choose the project in the project switcher at the top of the page. Project settings, People always shows the project you chose.
Have the person’s work email address ready, unless they already have an Orbit account (then you pick them from a list).
Pages for System Admins (Users, Teams, Access) are the tabs of Admin, People and access in the menu. The people of one project are on Project settings, section People, for Project Admins and System Admins.

The words used here

Console: the web site. Station: the program on a Windows PC that runs tests.
Project: one customer’s testing space. A person’s role belongs to a project, so someone can be a QA Lead on one project and a Viewer on another.
Team: a group of people. A team has a role on a project, and its members get that role.
Role: what a person may do on a project.
Account: the person’s sign-in. It has a system role, an expiry and a state (see “Accounts”).

The project roles

Each role includes everything the roles listed before it in this table allow.

Role	In plain words
Viewer	Looks at runs, results and reports. Cannot start anything.
QA Engineer	Also runs tests and does the daily work on failures.
QA Lead	Also decides what is quarantined, files Jira issues and manages releases and cycles.
Project Admin	Also sets up the project: environments, secrets, workloads, integrations and people.

The system roles

Role	In plain words
Member	The normal account. Has no power of its own. Sees only the projects its teams give it.
System Admin	Has every project role on every project, and also manages users, teams, projects, Stations and announcements. Needs the authenticator.

What you can do

yes means the role may do it. Taken from the rules the Console enforces.

What you can do	Viewer	QA Engineer	QA Lead	Project Admin	System Admin
View runs, results and reports (also AI diagnoses and investigations)	yes	yes	yes	yes	yes
Start runs	no	yes	yes	yes	yes
Run an AI diagnosis	no	yes	yes	yes	yes
Create and change investigations	no	yes	yes	yes	yes
Triage failures (test labels)	no	yes	yes	yes	yes
Quarantine tests	no	no	yes	yes	yes
Create Jira issues	no	no	yes	yes	yes
Override run profiles	no	no	yes	yes	yes
Manage releases, cycles, gates, decisions and risks	no	no	yes	yes	yes
Save report snapshots, schedules and share links	no	no	yes	yes	yes
Manage environments and run grants	no	no	no	yes	yes
Manage secrets and variables	no	no	no	yes	yes
Manage workloads	no	no	no	yes	yes
Manage integrations (Jira, Teams)	no	no	no	yes	yes
Add and remove people on the project	no	no	no	yes	yes
Delete run artifacts	no	no	no	yes	yes
Delete releases and cycles	no	no	no	yes	yes
Invite and manage users; read the audit log	no	no	no	no	yes
Manage teams, projects and project roles	no	no	no	no	yes
Enroll, revoke and configure Stations	no	no	no	no	yes
Publish announcements	no	no	no	no	yes

Running on a restricted environment needs more than the QA Engineer role: Project Admins and System Admins always may, QA Engineers and QA Leads only with a run grant (see below).

System Admins can see the same table, always up to date, on Admin, People and access, Access, tab Roles. It also gives each role a short description with examples of what it can and cannot do.

How access works

A person belongs to one or more teams.
Each team has a role on a project.
A person’s role on a project is the highest role of all their teams on it.

You rarely touch teams yourself. On Project settings, People, the Console keeps one managed team per role for the project:

Role	Managed team slug
QA Engineer	`<short-name>-team` (created with the project)
Viewer	`<short-name>-viewer`
QA Lead	`<short-name>-qa-lead`
Project Admin	`<short-name>-project-admin`

For the project example-customer these are example-customer-team, example-customer-viewer and so on. A team is created the first time someone gets that role. If another team already uses the slug, a number is added, for example -2.

Managed teams can only be changed on Project settings, People. Teams made by hand in Admin, People and access, Teams may span several projects and are changed only by System Admins. Their members appear on People marked “via team …”, and you cannot change their role there. A System Admin can turn a hand-made team that serves exactly one project into a managed team with Make managed… (Admin, People and access, Teams, on the team). Then its people can be managed on Project settings, People.

Add a person to a project

Open Project settings, section People.
Choose Add person. A panel opens on the Person box.
Choose the person:
- Someone who already has an account (the usual case). Click the Person box and pick from the list, or type to narrow it: it matches name, email and job title. The list holds every active account that is not yet on this project. Deactivated, expired and already-added people are not in it. Under the box a line says how many people it holds.
- Someone new. Choose Invite someone new instead. Then fill in Email and Name (needed for a new person). If the address turns out to have an Orbit account already, the person is attached as they are and the name is ignored. Choose Choose someone who already has an account to go back to the list. When the list is empty or could not load, the panel starts on the invite form.
Fill in the rest:
- Role. You can pick a role up to your own. System Admins can pick any.
- Account expires. Only for a new account (it is hidden when you pick an existing person, who keeps their own expiry). The default is 90 days from today; the latest allowed is 365 days.
- Run access on restricted environments. Tick the restricted environments the person may run on. This box only appears when the project has restricted environments.
Choose Add person. A message says “Added … as …”.

A new person receives an invitation email. An existing account is attached to the project and keeps its own expiry. You cannot add yourself, and you cannot add someone who is deactivated or expired (“This account is deactivated or expired. Ask a System Admin to restore it first.”).

Limits

You can give a role up to your own. A QA Lead cannot add people at all; only Project Admins and System Admins can, so in practice Project Admins can give any of the four roles.
New accounts always start as Member.
Project Admins can create 10 new accounts per day. The panel shows how many are left today. Picking an existing person does not count. System Admins have no limit.
New accounts made by Project Admins always expire, and the date cannot be left empty. System Admins can choose Never expires.
Project Admins see the name, email, picture, job title and department of every active account in the picker. They do not see phone numbers or notes of people who are not on their project yet.

Change a person

On Project settings, People, choose Edit on the person’s row.
Change the Role and/or Account expires, then choose Save. The panel also shows the person’s Phone and Notes from administrators when there are any (read only).

Rules:

You cannot change yourself. Your own row has no Edit or Remove. Ask another Project Admin.
You cannot give a role above your own, and you cannot change a role above your own.
Expiry belongs to the whole account. A Project Admin can change a person’s expiry only if the person is on this project only. If they are on other projects too, the box is locked with “This person is also on other projects. Ask a System Admin to change the expiry.” A Project Admin can set a date up to 365 days from today.
To change who may run on a restricted environment, see below.

Remove a person

Choose Remove on the row, then Remove from project to confirm.
The person loses their role on this project. Their account and their access to other projects stay.

The last Project Admin cannot be removed. Make someone else a Project Admin first.

Restricted environments and run grants

An environment can be Restricted. Then only Project Admins may run on it, plus people who were given a run grant. Everybody with a role can still view its results.

When adding a person, use Run access on restricted environments.
Later: Project settings, Environments, choose Edit on the environment’s row. In the Run access to part of the panel, pick the person under Grant someone… and choose Grant. Revoke takes it away.
The Run access column on Project settings, People shows who may run where.
A grant reaches the person’s Station within 5 minutes.
Only people with the QA Engineer role or higher can be granted.

When an account expires

On the expiry date the account moves to Expired, view only for 3 days. The person can still sign in and look, but cannot run tests or change anything.
After 3 days the account is Expired and can do nothing.
Project settings, People shows the state (Active, Expired, view only, Expired or Deactivated) and the date. Users shows Expired for both expired states (see “The State column”). A System Admin, or the Project Admin if the person is only on this project, can set a new date.
A Station treats an expired account the same way: view only (see Station run features).

Accounts (System Admins)

Admin, People and access, Users lists every account, with a search box (name or email). Select a person to open their sheet (tabs Account, Profile, Teams and Security). Only System Admins see this page. They need the authenticator verified in the session, unless the organisation switch is off (see “The authenticator”).

Create an account

Choose Add user. Under How will they sign in? pick one of two ways:

Email an invite: the person gets a link and chooses their own password. Button Send invite.
Set a password now: the account works at once and you hand the password over yourself (in person or by phone, never in chat or mail). Generate makes a readable password of 16 characters; at least 12 are needed. Button Create account. Orbit shows the password once, on the “Account created” screen, and never again.

Then fill in Email, Name, Role (Member or System Admin), Account expires (empty means no expiry) and, if you like, a First team (No team yet by default). More teams can be added on the Teams tab once the account exists.

Most people reach a project more simply through Project settings, People (see above), which creates the account and the role in one step.

The State column

The list shows one state per person:

State	Meaning
Active	The account can sign in.
Not invited yet	The account was created by a configuration import and has no invite yet. Choose Send invite on the row (see Move or copy the configuration).
Invited	The person was invited by email and has not accepted the invite yet. Password sign-in is refused until the email is confirmed.
Expired	The account expired. During the 3 days of view only, and after them.
Deactivated	The account was deactivated: signed out and cannot sign in.

There is no separate “Confirmed” mark: an account that accepted its invite shows Active. If Orbit cannot read the sign-in status (the sign-in service did not answer in time), the state also shows Active, and the page still works.

For an Invited account the Account tab says “Invite not accepted”. Three ways forward:

Resend invite (Account tab): sends the link again.
Confirm email (Account tab, only for an Invited account): confirms the address without the person opening the invite. They can then sign in with a password you set.
Set a new password… (Security tab): also confirms the email, because you vouch for the person.

A person who tries to sign in with an unconfirmed address sees “Your email is not confirmed yet. Ask an administrator.” Steps: People account recovery, section A.

Role and expiry

In the Account tab of the person’s sheet change Role (Member or System Admin) and Account expires, then choose Save account. You cannot change your own role: another System Admin has to. In the list you can also select several people and choose Extend expiry or Deactivate for all of them.

Deactivate, reactivate and delete

Deactivate… (then Deactivate ) signs the person out everywhere, Stations included, and refuses them until you reactivate. Their teams are kept. You cannot deactivate yourself.
Reactivate restores the account with the same teams.
Delete user… (in the Danger zone of the Account tab) removes the account for good, and works only for an account without history: one that never ran a test, wrote an investigation or comment, appears in the audit log or owns a shared item. Typical cases are a mistaken invite or a test account. You type the person’s email to confirm. If the account has history, Orbit says what it has (“… cannot be deleted: the account has 12 audit entries, 3 runs. Deactivate it instead.”) and only Deactivate applies. Signing in alone does not count as history.

Account actions on another person

On the Security, Profile and Account tabs of the person’s sheet. They are not offered on your own row, where Orbit says to use Profile instead.

Button	Tab	What it does
Set a new password…	Security	Sets a password you hand over yourself (Generate or type one of at least 12 characters, then Save password). Also confirms the email.
Reset authenticator	Security	Removes every authenticator of the person. See “The authenticator”.
Change email…	Security	Changes the address the person signs in with (New email address; leave Mark the new address as confirmed on when you vouch for it).
Remove picture	Profile	Removes the person’s profile picture (shown only when they have one).
Delete user…	Account, Danger zone	See above.

Each is audited. Recipes: People account recovery.

Your Profile

Everyone opens Profile from the account menu. It has the tabs Info, Security, Access, Station, Activity and Preferences. Station is where you request a Station for your PC (see Install the Orbit Station).

On Info:

Your picture. Choose Upload picture (png, jpeg or webp up to 5 MB; Orbit crops a square from the middle), Change picture or Remove picture. Without a picture Orbit shows your initials, for example MN for Mai Nguyen, on a colour that belongs to you.
Your name. The Display name shown on runs, releases and comments.
Details. Job title, Department or company, Phone, Time zone (type a city or region such as Europe/Paris, or choose Use it to take your browser’s zone) and Language. Choose Save details. Your time zone and language are used to show dates.
Account. Set by your administrator: your Email, System role and Account expiry. Ask them if something is wrong.

Who sees what:

Detail	Who sees it
Name, picture, job title, department	People on your projects, in the people lists, and administrators
Phone	You, System Admins, and the Project Admins of the projects you are on (so they can reach you)
Admin notes	System Admins, and Project Admins of your projects (read only, shown as Notes from administrators). Only System Admins write them, on Users, on the Profile tab of the person’s sheet. You never see them.
Time zone, language	You and administrators

A System Admin can also edit your name and details on Users (the Profile tab of your sheet, Save profile). A Project Admin cannot edit anyone’s profile.

Sessions

Sign out (account menu) ends your session in this browser.
Profile, Security, Other devices: Sign out other devices signs you out of Orbit everywhere except this browser, Stations included. Use it when a device is lost or a sign-in under Recent sign-ins looks wrong, and change your password too.
There is no “Sign out everywhere” for an administrator to press for someone else, because the sign-in service has no way to end a person’s sessions by id. To cut someone off, Deactivate them: Orbit refuses the account at once.

Teams (System Admins)

People get access to projects through teams. Admin, People and access, Teams is where the teams live. There are two kinds, switched with the Shared teams and Project teams tabs (the list opens on Shared teams):

Shared teams are made by hand and can serve several projects. A System Admin edits them here.
Project teams are the managed teams of a project. Here they are read-only; Open People goes to Project settings, People of that project, where its Project Admins change them.

To make a shared team choose Create team. On a shared team you can:

Rename and Archive… (from the team’s menu; an archived team shows Restore), and Delete team in its danger zone.
Edit Details: a Description and a Lead, then Save details. The lead is shown for reference only and gives no extra permission. It must be a member; when the lead leaves the team the lead is cleared.
Give the team access under Access to projects: pick a project in Add a project…, its role, and choose Add. Change the role in the list, or choose Remove to take the access away.
Manage Members. Under Add members pick several people at once (a search list of active accounts) and choose Add N people (Add for one person). To remove, tick people (or Select all) and choose Remove selected (N). At most 100 people at a time; beyond that the page says “Select at most 100 at a time”. People who cannot be added (already in the team, deactivated or expired) are skipped and named in the result message.

Two notices appear beside a shared team: No members, and No project role (the team gives access to nothing). They are reminders, not errors.

A person’s teams are also in the Teams tab of their sheet on Users: shared teams as chips with a remove button, Add to a team… to join one, and project teams as read-only lines linking to the project.

Access (System Admins)

Admin, People and access, Access answers “who can do what, and why”. The views (a second row of tabs under Access) are:

Tab	What it shows
Roles	The four project roles and the actions each allows, with a short description and examples of what the role can and cannot do, plus the system actions.
By project	Pick a project: who has which role, through which team (project team or shared team), account state, expiry and run access on restricted environments.
By person	Pick a person: system role, account state, expiry, and for every project the role they have, the team behind it and their run access. Explain is here.

See changes (in the header), See changes on this project (in By project) and See changes for this person (in By person) open Admin, System, Audit log filtered to the access events: role, team, project people and run-grant changes, newest first.

Explain is at the bottom of By person. Choose an Action (for example starting a run), then the Project and, for runs, the Environment. Orbit answers “Allowed: …” or “Not allowed: …” with the reason, using the same rules as when the person tries. How to read it: People account recovery, section G.

Export CSV (top right) downloads one row per person and project, for an access review: People account recovery, section F. System Admins act on every project with no team, so a notice names them on By project and By person, and the export has a row for each.

The authenticator

While the organisation switch is on, System Admins confirm a code from an authenticator app before admin actions. A System Admin with no authenticator sees “Admin actions need an authenticator.” with Set it up; one who has one sees “Admin actions need your authenticator code.” with Enter the code. Everyone can add or remove their own authenticator on Profile, Security (a System Admin must always keep one). A System Admin can turn the rule off or on for everyone on Admin, System, Security, and can Reset authenticator for another person who lost theirs. When the rule is off, only the code step is dropped: sign-in with email and password stays, and people keep the authenticator they added. Keep the rule on unless you have a reason: without it, a guessed admin password gives full admin access. For a lost authenticator, see People account recovery, section B.

Who may do what with people

	System Admin	Project Admin	QA Lead, QA Engineer, Viewer	The person
Account: invite, resend, set password, confirm email, change email	yes	invite new (limit), attach existing	no	no
Account: deactivate, reactivate	yes	no	no	no
Account: delete (no history)	yes	no	no	no
Profile: display name, picture	edit, remove picture	read on the project	read	edit own
Profile: job title, department, timezone, language	edit	read job title, department, picture of people on the project	read job title, picture in people lists	edit own
Profile: phone	edit	read for people on the project	no	edit own
Profile: admin notes	edit	read for people on the project	no	no
System role (System Admin or Member)	yes	no	no	no
Team membership and project roles	all	managed teams of the project, role no higher than own	no	no
Authenticator	reset	no	no	add, remove own
Sessions	not available (see “Sessions”)	no	no	sign out other devices
People list of a project	all	own projects	own projects (name, picture, role, job title)	n/a

Who to ask when you have no access

No project at all (“You are not on a project yet.”), or a Project settings section that says “Only Project Admins open …”: the page names the Project Admins of the project, or the System Admins, to ask.
You can view but not run: ask a Project Admin for the QA Engineer role. For a restricted environment, also ask for a run grant.
You need a system change (teams, projects, Stations, users): ask a System Admin.

If something goes wrong

Message	What it means and what to do
“You can only give a role up to your own.”	Pick a lower role, or ask a Project Admin or System Admin.
“The project needs at least one Project Admin. Make someone else one first.”	Promote another person, then remove this one.
“You cannot change your own role or remove yourself. Ask another Project Admin.”	Another Project Admin has to do it.
“Choose an expiry after today and within 365 days from now.”	Pick a closer date.
“This person is also on other projects. Ask a System Admin to change the expiry.”	Ask a System Admin.
“You have reached the limit of 10 new accounts in 24 hours. Try again tomorrow.”	Wait, or ask a System Admin. People who already have accounts can still be added.
“This address has no Orbit account yet. Enter the name of the person.”	Fill in Name.
“Verify your authenticator first, then try again.”	System Admins: choose Verify now, enter the code.
“This account is deactivated or expired. Ask a System Admin to restore it first.”	A System Admin reactivates the account or extends the expiry on Users.
“Your email is not confirmed yet. Ask an administrator.” (on the sign-in page)	A System Admin follows section A of People account recovery.
“… cannot be deleted: the account has … Deactivate it instead.”	The account has history. Use Deactivate….
The role of someone shows “via team …” and has no Edit.	Their team was made by hand. Ask a System Admin to use Make managed… on it.