Projects and delegated access

A project is a server folder linked to an organization. Project members receive selected permissions on the servers inside it.

Audience, availability, and prerequisites

This guide is for folder owners and collaborators at cloud.8labs.id. Availability depends on hosted configuration and permissions.

The folder owner manages its organization link, members, and project invitations. Platform operators can also manage these controls. To link a folder, you must own the folder and be an owner or admin of the target organization.

Have a folder, a suitable organization, and each collaborator’s correct account email ready. Organization admin status alone does not let you edit another person’s folder membership.

Choose the right scope

Project membership grants selected actions on every server in that project.
Server subuser grants selected actions on one server, independently of organizations.

A user’s effective access combines all applicable grants. Moving a server into a project changes which project permissions apply to it. Review access before changing project contents.

Available permissions

The permission picker groups permissions by area and offers category-level selection.

Area	Permission identifiers
Control	`control.console`, `control.power`
Backups	`backup.read`, `backup.write`, `backup.restore`
Snapshots	`snapshot.read`, `snapshot.write`, `snapshot.restore`
Settings	`settings.manage`, `settings.reinstall`
Firewall	`firewall.manage`
Activity	`activity.read`

Choose only the actions needed. Restore and reinstall permissions can allow destructive changes; discuss recovery requirements before granting them.

Server owners, platform root admins, and applicable organization owners/admins have implicit wildcard (*) access. Restricted project permissions do not reduce their broader access. An organization admin is not a platform root admin.

Open the servers page and locate your folder.
Open its Share dialog.
Select an organization that you own or administer.
Save the organization link if the dialog requires it before member actions.
Start typing a name or email to choose an existing organization member.
For another existing account, enter its email and use the direct member action.
Select the required permissions and save.
For someone without an account, select permissions and choose Invite link, if available.

Adding an existing account to a project automatically adds it to the linked organization as a Member, if needed. It does not promote an existing organization role. You do not need a separate organization-member step.

An invitation is different from a completed membership. Share its link privately and wait for acceptance. See invitations.

Confirm completion

Wait for the saved member row or invitation confirmation. Ask an accepted member to select the organization workspace and open the project.

Confirm access to the intended servers and actions. Creating a membership does not start, install, or modify the servers themselves.

Change or remove access

Reopen the folder’s Share dialog.
Use the member row’s pencil action to change permissions, then save.
Use the remove action to delete that project membership.
Review Pending invites below the member list.
Copy a pending invitation link again or revoke it when it is no longer needed.

Revoking an invitation invalidates its link; it does not remove access already granted through an accepted membership.

Removing one project grant does not revoke every access source. Check other projects, direct subuser grants, organization roles, and server ownership during offboarding.

Troubleshooting and escalation

Cannot select an organization: confirm you own or administer it and own the folder.
Folder must be linked first: save an organization link before adding project members or invitations.
Account not found: check the email; use an invitation only for a person without an account.
User already exists or is already a member: add the account directly or edit its existing member row.
Owner cannot be added: the folder owner already has full access.
Access is broader than the picker: review the combined access model.

If the saved permissions do not match observed access, stop broadening grants and contact the folder owner or support. Include the project and server identifiers, intended permissions, and error text. Exclude invitation tokens and API keys.

Organizations
Server subusers
Invitations
Personal API keys: delegated resource permissions also apply to API requests.
Server folders