Teams and access rules
A teammate who needs to tail a log does not need a root shell. Access in Paperboat is a short file of rules, and one command tells you what any rule lets anyone do.
$ pb policy explain --src user:bo@example.test --dst machine:db --action private_access --port 5432
ALLOWED: rule
Rules: /rules/2$ pb policy explain --dst machine:db --action exec- 1
Ask why someone can, or cannot, do something. The answer names the rule.
- 2
Or ask who can run commands on a machine.
The whole policy is one file
Group people, tag machines, allow or deny. A deny always wins, and the owner can never lock themselves out.
pb policy set shows whose access would change before saving, and every save can be restored. The console edits the same
file as a grid.
{
// Reaching ports is off for a team until you turn it on.
"allow_private_access": true,
"groups": {
"group:ops": ["user:ana@example.test", "user:bo@example.test"]
},
"tags": { "tag:prod": ["machine:db", "machine:web-01"] },
"rules": [
// Ops can do everything on production.
{ "src": ["group:ops"], "dst": ["tag:prod"], "allow": ["*"] },
// Nobody opens an SSH session there, ops included.
{ "src": ["*"], "dst": ["tag:prod"], "deny": ["managed_ssh"] },
// Every member may reach the database port, and only it.
{ "src": ["role:member"], "dst": ["machine:db"],
"allow": ["private_access"], "ports": [5432] }
]
}Permissions
Each is granted per machine or per tag. ENV has its own two, for reading and for changing a team's values.
terminal | Open and attach to terminal sessions |
|---|---|
exec | Run single commands |
managed_ssh | SSH, scp, sftp and rsync |
files | Send files to the machine's Inbox |
preview_manage | Start and stop previews from the machine |
tunnel_manage | Create and change tunnels on the machine |
private_access | Reach its ports, optionally only listed ones |
Roles
Roles are about administration only. Using machines is always the policy's decision.
| Owner | One person. Can delete the team or transfer it. |
|---|---|
| Admin | Members, machines, policy, security settings and the audit log. |
| Billing | Plan, seats, extra bandwidth and invoices. Nothing else. |
| Auditor | Reads everything an admin sees, and exports the audit log. Changes nothing. |
| Member | Uses what the policy grants. |
API tokens
An API token acts as the person who made it, narrowed to the scope you give it, until it expires. If its creator loses access, so does the token.
Use one in CI or hand one to an agent. The secret is shown once.
$ pb api-token create ci --expires 30d --scope '[{"dst":["tag:ci"],"allow":["exec"]}]'$ pb machine tag build-01 add ci$ pb api-token list
$ pb api-token revoke ci- 1
Thirty days, exec only, only on machines tagged ci.
- 2
Tagging is a reviewed policy change, like any other.
Business features
All of it is part of the Team plan at $15 a seat. Single sign-on and directory sync need a team of at least 10 seats.
Single sign-on
SAML or OpenID Connect with a verified domain. Turn on Require SSO after reviewing who would lose access; the owner stays as the break-glass account.
Directory sync
People added to or removed from your directory are added to or removed from the team, with roles mapped from directory groups.
Audit log
Search by person, action, target and result. Export as CSV or JSON, or stream it, signed, to an HTTPS endpoint or S3-compatible storage.
Session recordings
Record Paperboat terminals by rule or by hand. Recordings are encrypted and archived to your own S3-compatible bucket; every replay is audited.
Machine approval
A team can hold a member's newly shared machine until an owner or admin accepts it.
Team secrets
A team has its own ENV scope with its own keys. Rules decide who reads and who writes.
Questions
Does joining a team give someone access to my machines?
No. Membership grants nothing by itself. A machine is shared with a team on purpose, and each person's access to it is a rule you can read.
Do I need the Team plan for tags, the policy file and API tokens?
No. They work in a personal workspace on Free and Pro, for example to give a CI token nothing but exec on machines tagged ci. Team adds members, roles and audit log export, and single sign-on and directory sync from 10 seats.
What happens when someone leaves?
Remove them, or let directory sync do it when they are removed from your identity provider. Their open sessions end at once, their team API tokens are revoked, and machines they shared leave the team.
Which identity providers work for single sign-on?
Any SAML or OpenID Connect provider, including Okta, Microsoft Entra ID and Google Workspace. Your IT admin sets it up in a guided portal, and you can then require SSO for the whole team. It is available to teams with 10 or more seats.
What does the audit log record?
Who did what to which machine or setting, whether it was allowed, and from where. Never terminal contents, file contents or secrets. It is kept 30 days on Free, 90 days on Pro and 365 days on Team, where you can also export it or stream it to your own storage.
How is a team billed?
$15 per seat a month, or $150 a year. Every member takes a seat whatever their role. Seats added mid-cycle are charged right away, and the billing date does not move.
Related
Start with the machine in front of you
Install Paperboat here, then on a second machine. Free for personal use, no card needed.
$ curl -fsSL https://get.pprbt.dev/install | bash > irm https://get.pprbt.dev/install.ps1 | iex