TracesHub’s access model has two independent axes: org role (who can manage things) and traces access (who can see and push trace data). Understanding both takes about a minute.
Organizations
Every user gets a personal org at first sign-in. Installing the GitHub App on a GitHub organization creates a matching team org; repos imported there become its projects. You switch orgs from the org switcher in the app header.
Org roles — who manages
Each member of an org has one role:
| Role | Can do |
|---|---|
| owner | Everything: manage members and roles, projects (enable/disable traces, delete), sharing, data export. An org must always keep at least one owner. |
| admin | Same management powers as owner. |
| member | Uses the org’s projects per their traces access; no management. |
Roles are managed in Settings → Organization members (owners/admins only; the last owner can’t be removed or demoted).
Traces access — who sees and pushes
Traces access is a per-user level on trace data: read (browse analytics, files, conversations), write (read + push traces), or admin (write + trace-data administration). A user’s effective access to a project is the stronger of:
- their org membership default — set per member in Settings → Organization members (new members default to write), and
- any project collaborator grant — set per project on its Share tab.
So the org default is the baseline, and collaborator grants raise access for specific projects and specific people. Someone with no org membership and no collaborator grant has no access at all — the project isn’t even visible to them.
The effective level also caps what API tokens can do: a token is never stronger than the access of the person who minted it, evaluated at use time.
Project collaborators
The project’s Share tab (org owners/admins manage it) grants direct access on top of org membership:
- Add a collaborator by GitHub login with read / write / admin — they must have signed in to TracesHub at least once.
- Change or remove a grant any time; the list shows each collaborator’s current level.
Typical uses: giving an outside reviewer read on one project, or a contractor write on the single repo they work on, without adding them to the org.
Invitations
For people who haven’t signed in to TracesHub yet, create an invitation instead:
- From a project’s Share tab, pick the access level and optionally an email — you get a link to share; the email is a label for your bookkeeping.
- The invitee opens the link, signs in with GitHub, reviews what they’re being granted (org, project, access, who invited them), and accepts or declines.
- Invitations expire, and pending ones can be revoked from the same tab.
Org-level invitations work the same way and grant membership with a role and default traces access.
The dashboard view
The dashboard lists projects across your orgs (filter by org with the switcher). Each card shows the project’s traces on/off state and your effective access level — so it’s always visible what you can do where.