Set team policies and roles

A team owner can set rules for everyone in the team (policies), let admins and custom roles change the team within limits, and see reports of what each member’s device applies. Policies are signed into the team’s member list by the owner or an allowed admin, so the sync server cannot change them, and each member’s app checks them.

Everything here is under Settings › Account & Sync › Teams › (your team), with the tabs Overview, Policies, Roles and governance, Proposals and Reports. The phone app has the same screens.

Turn on team policies (owner, once)

A team made before team policies uses the older kind of signed member list, which only the owner signs. To use policies and roles:

1. Open the team and choose Turn on team policies.
2. Choose Who signs changes: Owner and admins (admins and roles you grant sign changes within the rules) or Only you.
3. Confirm. There is no way back to the older kind.

Before you do it:

• The sync server must be recent enough to keep the new kind of list; Sternway says so if it is not.
• Members’ apps from before team policies keep the last list they verified until they are updated. Devices that don’t report team policies yet lists your own devices that need updating.
• Most policies need a plan or licence that includes them; see Team policies for which.

Set a policy

1. Open the Policies tab. Policies are grouped as Account access, Devices, Hosts and SSH, Team data, and Recording and retention.
2. For a policy, choose its Policy mode:
   • No policy: each member decides.
   • Suggested: applies where a member has no setting of their own; they can choose Use mine.
   • Locked: a floor; members can be stricter, never looser.
3. Set its value and a Reason (up to 280 characters). Members see the reason beside the setting. The sync server can read policy values and reasons.
4. Choose Save policies.

Each policy says whether the server enforces it (sign-in requirements, the oldest app version, retention on the server) or each member’s app does (the app lock, host key checks, agent forwarding, exports and the rest). A modified app can ignore an app policy, and a malicious server can skip a server policy while showing it as on; Reports show what each device says it applied.

Members see a locked setting as Managed by (team), with the reason. A policy never makes a member’s own setting looser, and with several teams the strictest one applies. Some policies cover only the team’s own hosts and data; others (such as Require the app lock) cover the whole device, which then holds the team’s vaults until the device meets them.

Every policy, its values and who enforces it: Team policies.

Making a policy looser

Relaxing a policy asks you to confirm it is you (your password, and a code with two-factor on), and the owner is told. As owner, in Roles and governance › What admins may do, you can also require:

• Relaxing a policy needs your approval: an admin’s relaxation waits as a proposal.
• Delay before a relaxation takes effect: the stricter setting stays for that time, so you can revert it. While a relaxation is pending, members see Stricter setting applies until …, and Cancel this change brings the stricter value back.

Give admins and roles

1. Open Roles and governance.
2. Change a member’s Role to Admin, or choose New role to make a custom role with exactly the Permissions you tick (invite and remove members, create, share, rotate and delete vaults, manage policies, view reports, export the audit log).
3. A role that signs changes goes only to people whose safety number you verified on their member row.

Admins can do everything the owner allows except what only the owner does: transferring ownership, deleting the team, single sign-on, roles themselves, and the governance switches. Admins may delete vaults and Deleting a vault needs your approval are the owner’s choices; a deleted vault can be restored for 30 days.

Proposals

When a change needs the owner’s approval, or an admin is past a daily limit, the admin’s app sends it as a proposal. The owner sees it under Proposals: Accept and sign signs exactly the change shown, against the team as it is now; Decline drops it.

Reports

Reports (owner, admins and roles with the reports permission) are built on your device from the signed member list, the server’s records and what each member’s device reports: access matrix, two-factor coverage, devices and their app versions, key age, unverified safety numbers, expiring access, policy compliance, an audit summary, the signed change history and more. Each column says whether it comes from the signed list, the server or a device. Export CSV saves a report; Compliance PDF needs a plan that includes it.

A device’s report is evidence, not proof: it is signed with the member’s own key, so the server cannot forge it, but a modified app could report what it likes.

The licence

Teams › Licence shows the licence of the server: the plan, seats, expiry, add-ons and the addresses it is bound to. Without a licence a self-hosted server offers the features of the free plan, plus SSO, Require 2FA and the audit log. See Licensing of self-hosted servers.