Teams, Workspaces, Members, and Roles
Telemetry uses teams as the top-level collaboration boundary and workspaces to organize saved queries. A new account receives a default workspace so the first event and query have an immediate home.
Plan the structure before inviting a large group. Team and workspace names often become durable navigation, while membership determines who can reach shared analysis.
Teams and roles
Telemetry currently distinguishes team administrators and members. Administrators can manage team settings, invitations, member roles, and removals. Members can use the team resources made available to them.
Do not interpret these two roles as a complete enterprise authorization model. If your organization requires custom roles, approval workflows, directory synchronization, or field-level access rules, confirm the current product behavior before using Telemetry for that boundary.
Keep at least two active administrators for a production team so access does not depend on one person. Review administrator membership after role changes and offboarding.
Invite members
The team settings area provides an invite link and invitation controls. Treat an invite link like a credential:
- send it only through an approved channel;
- reset it if it was posted publicly or reached the wrong audience;
- review pending invitations;
- remove access promptly during offboarding;
- verify the intended role after the person joins.
Before inviting an external collaborator, review whether existing workspace names, saved query titles, dashboard text, or result fields expose customer or operational detail.
Organize workspaces
Workspaces contain saved queries and can be nested under a parent workspace. A workspace can represent a service, product area, business workflow, or temporary investigation.
Use a stable naming scheme, for example:
production-reliability
api
queues
product-analytics
activation
retention
Avoid copying the same query into several workspaces. Keep one reviewed definition and link its result from the dashboards or operating notes that need it.
Workspace membership is separate data from team membership. Confirm the intended members when creating or reorganizing a restricted workspace. Moving or nesting a workspace should not be used as a substitute for reviewing its membership.
Review access safely
Use this checklist for a production team:
- Identify current administrators and an offboarding owner.
- Review pending invitations and reset an exposed invite link.
- Confirm workspace memberships for restricted analysis.
- Remove raw secrets, tokens, prompt content, and unnecessary personal data from events.
- Keep broad dashboards aggregated where possible.
- Test with a non-admin account before assuming a member can or cannot reach an artifact.
- Record any authorization requirements that the current admin/member model does not express.
Application-level authorization still belongs in your application. Telemetry event fields and SQL filters are analytical tools; they must not be treated as row-level security for the source product.
Continue with API Keys and Authentication, Saved Queries and Collaboration, and Redacting Sensitive Data.