With a shared administrator login, removing one teammate’s access means changing the password for everyone who uses it. You also cannot give a CI job fewer permissions than a person using that same login. Separate accounts and scoped credentials let you manage those grants individually.
Start with named people and a clear scope
Basic self-hosted teams, invitations and fixed project roles are included in Hakopod Free. Use them to give people access to the work they share, instead of passing around installation-wide credentials.
Projects and environments give that access context. A person working on a development application does not automatically need the same authority over production. Pick the smallest useful scope, then check that the person can complete the intended workflow.
Deployment access lets someone run code that can read the secrets bound to its service. Keeping a secret value out of the dashboard does not make it inaccessible to someone who can replace the workload using it.
Give automation its own credentials
A CI pipeline should use a scoped machine credential, not a browser session borrowed from an administrator. That makes its permissions easier to review and its access easier to replace when the workflow changes.
Keep the token out of repository files and command output. When a deployment request fails, diagnose the response without printing the credential into a shared log. A credential printed during debugging can remain in retained logs after the problem is fixed.
When a teammate leaves or a pipeline is retired, remove the corresponding access deliberately. A common password makes that process harder because every user and script becomes part of the same rotation.
Know which controls exist today
Free collaboration covers teams, invitations and fixed project roles. Actor audit history requires a signed Pro entitlement. Custom roles and organization MFA enforcement remain planned.
You can use basic team collaboration without paying for audit history. If you need custom roles or organization-wide MFA enforcement, the current fixed roles do not provide them.
List who needs to deploy, who needs to inspect, and which environment each person needs. Compare that list with the actual grants. Repeat the exercise when the team changes.
The security and access guide explains the current boundaries and the responsibilities that remain with the installation operator.