Access & Permissions
Read, write, manage — and why production is different.
Access is granted per environment, at one of three levels:
| Permission | Can do |
|---|---|
| read | View and pull secrets |
| write | Everything read can, plus push and change secrets |
| manage | Everything write can, plus invite others and manage access |
Each level includes the ones before it — write implies read, manage implies both.
Who gets access, and why
This is the practical meaning of "production stays explicit": being on the team gets you into development immediately; getting into production is always a deliberate, visible act — either accepting an invitation or being granted access directly, both of which show up in the audit log.
Service tokens
A service token is scoped exactly like a human grant — one environment, one permission level — but it isn't tied to any person's session. Revoking it doesn't sign anyone out; it just stops that one credential from working.
Checking what's granted
envi activity
shows recent reads and writes across the org, including which identity — human or service token — touched what.