> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rafftechnologies.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Team & Projects
> Team & Projects on Raff — invite members, organize resources into projects, scope access at the account or per-project level, and assign roles
Updated May 8, 2026
**Team & Projects** is where you decide who has access to what on your Raff account. It has three pieces, each on its own tab:
| Tab | What it controls |
| ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Members** | The people who can sign in to your account — invite, set their access scope, remove |
| **Projects** | Groupings of resources (VMs, volumes, IPs, VPCs, etc.) used for access control and organization. Every account has a `Default` project you can never delete |
| **Roles** | The named permission sets you can assign to members at the account or project level |
## Two separate permission systems — Account and Project
Raff splits permissions into **two independent systems**. They look similar in the UI but they cover **completely different things**, and granting one does **not** grant the other.
| System | Controls | Example permissions |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
| **Account permissions** | Account-wide features — invite members, manage billing, view audit logs, manage account settings, manage account-wide API keys, list of projects, the role catalog itself | `account.members.invite`, `account.billing.manage`, `account.audit.view`, `account.apikeys.create` |
| **Project permissions** | Resources that live inside a project — VMs, VPCs, public IPs, snapshots, the project's members, the project's settings | `vm.create`, `vm.power`, `vpc.manage`, `project.members.invite` |
A member's grants are tracked separately in each system:
* **Account roles** are assigned once per member at the account level — they apply across the whole account
* **Project roles** are assigned per project — the same member can have `Project Admin` on `customer1` and `Viewer` on `staging`, or no project role at all
**An account role does not grant access to any project's resources.** A member with the `Admin` account role and no project roles can invite members, manage billing, see the list of projects' names — but they cannot list VMs, see VPCs, or open any project's resources. Project access has to be granted explicitly, per project.
The **Owner** is the only exception: granted automatically at signup with full access in both systems on every project, current and future. Every other member you invite is scoped narrower than that.
The Members list shows where each member sits with badges:
| Badge | Meaning |
| ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Owner** | Full account permissions + full project permissions on every project. Granted automatically at signup. One per account |
| **Account** | Has an account role (Admin / Billing / Member). May or may not also have project roles — those are added separately |
| **Project-only** | No account role at all — only has project roles on specific projects. Useful for customers, contractors, anyone who shouldn't see account-wide info |
## Projects — the unit of access control
Every resource on Raff lives in a **project**. VMs, volumes, public IPs, VPCs, Object Storage buckets — all of them are scoped to one project at creation time. Projects are how access control gets fine-grained.
A few things every account should know:
* **Every new account starts with a `Default` project.** It's pre-created at signup and used for any resource you create without picking a project explicitly. The Default project cannot be deleted — it's the always-available fallback.
* **You can create more projects.** `+ Create Project` from the Projects tab. Use them to isolate customers, environments (`prod` / `staging`), teams, billing entities, anything where access should be partitioned.
* **Single project is fine.** If you don't need access partitioning, leave the Default project as your only project and forget about it. The account works the same way.
* **Resources never leave their project.** A VM created in `customer1` stays in `customer1`. Today there's no "move to another project" action — recreate elsewhere if you need to relocate.
## How users switch projects
The top bar of the dashboard has a **project picker** next to the account name. Members with access to multiple projects use this to scope the dashboard to one project at a time.
Whatever project is selected here, **every list page in the dashboard filters to that project's resources** — Compute, Networking, Object Storage, all of it. Switch projects and the dashboard re-scopes immediately. The dropdown only lists projects the member actually has a project role on (the Owner sees all of them).
The selected project also determines where new resources land — clicking **+ Create** at the top right while `customer1` is selected creates the new VM / volume / IP inside `customer1`.
## What you can do
| Task | Where |
| ---------------------------------------------- | --------------------------------------- |
| Invite a new member | **Members** tab → **Invite Member** |
| Change a member's scope or projects | **Members** tab → row's `⋮` |
| Remove a member | **Members** tab → row's `⋮` → Remove |
| Create a new project | **Projects** tab → **+ Create Project** |
| Rename or delete a project | **Projects** tab → row's `⋮` |
| Switch the dashboard's view to another project | Top bar → project picker |
| Generate an API key | **API Keys** in the left sidebar |
API keys are managed in a separate left-sidebar item, **API Keys**, not on the Team & Projects page. They're tied to your account and inherit the scope you give them at creation.
***
## Most viewed
Add a teammate at account or project scope.
Group resources into a new project.
The Account vs Project permission model.
Create a key for programmatic access.
***
## Browse
Members, roles, API keys.
Account vs project scope, roles, API key scope.
Permission matrix and limits.
Common access issues.
API key authentication reference.
All API updates and changes.