Chapter 9
Captain and Crew
Teams: one or more Captains, any number of Crew, and what each can do. Switched on per customer, for teams only.
Status: only for teams, switched on per customer
ARRIVING · Only for teams, switched on per customer
Teams are built, and are switched on for a customer when that customer's team is set up. If your rail has no Team entry and your sign-in page has no "Sign in to a team" line, your environment does not have Teams and nothing in this chapter can be done. Where this chapter and the product differ, the product is right.
Without a team, every person has an individual account: their own sign-in with Google, their own connections, chats, modes and approvals. With a team, each person still has their own connections, chats, modes and approvals. What the team adds is one place where a Captain decides who is in and which connectors each person may use.
Captain and Crew
| Role | Who | What they can do |
|---|---|---|
| Captain | The team's administrator. The first Captain is set up by the Cockpit owner when approving the team's request. A Captain can make another person a Captain. | Invite people by email, choose what each may connect, change or remove access, promote another Captain, remove a member, read the team's activity log. A Captain is also a normal user with their own connections and chats. |
| Crew | Everyone else on the team. There is no seat limit. | Work as an individual does: their own connections, chats, Sandbox or Production mode and approvals, limited to the connectors the Captain allowed. |
A person belongs to one team at most. There is no directory or single sign-on in the first version.
How a team starts
An architect asks for a team account on the request form, naming the team.
You should see The request reaches the Cockpit owner as a team request.
The Cockpit owner approves the request as a team, and enters the Captain's name and email.
You should see The Captain receives an invitation email.
The Captain follows the link in the email, chooses a password and signs in.
You should see The console opens, with a Team entry in the settings list.
The Captain invites each person from the team page (9.1). Each person receives an invitation email, chooses a password and signs in at the team door (9.3).
Team members sign in with an email address and password, on a separate door of the sign-in page, not with Google. Members do not have a 7-day trial clock. The desktop apps hand sign-in to the browser, as they do now (9.3).
9.1 The Captain's team page
A Captain opens Team from the settings list (the same list as Connectors and Account) or goes to /app/team. The page is called Your team members. At the top it says which team you are a Captain of. Below it are the invite form and the list of people.
Invite someone
Under Invite someone, type the person's Email address. The Name is optional.
You should see If the address is mistyped the page says "Enter a valid email address." and sends nothing.
Choose Starting access: Everything (read and write), Salesforce only, Salesforce and MuleSoft, or Nothing yet. Press Send invitation.
You should see The page says "Invitation sent to <address>." and the person appears in the list as Invited.
Two other lines can appear instead. "... already has a sign-in. They can sign in at the team door and the invitation is accepted." means that address already has a Cockpit sign-in, so no email was needed. "... is added, but the invitation could not be sent just now. Use Send again in a moment." means the sign-in service could not be reached; the person is on the list, and Send again tries once more.
Change what one person may connect
Find the person in the list. Under Connector access for <name>, set each connector (Salesforce, MuleSoft, Slack, GitHub, Postman, Workstation) to Not enabled, Read only or Read and write.
You should see The line below the lists, "Now: ...", still shows the saved access until you save.
Press Save access for <name>.
You should see The page says "Access updated for <name>." and the "Now:" line changes. The button is greyed out until you change something.
Change a role, resend or remove
To make someone a Captain or take that back, choose Captain or Crew in their Role list and press Change role.
You should see "<name> is now a Captain." or "<name> is now Crew." A Captain can use every connector, so a Captain's access lists are replaced by a note saying so. You cannot change your own role.
To send an invitation again, press Send again on a person who shows Invited. An invitation that has run out shows Invitation expired; Send again makes a new one.
To take someone out, press Remove. Confirm the question.
You should see For someone already in: "Remove <name> from the team? Their sign-in stops working and their connections to your systems are cut off right away." For an invitation: "Cancel the invitation to <name>?" Then "<name> was removed."
Each active person's line also says what they have connected (for example "Connected: Salesforce (dev)"), or "Nothing connected yet.", and what they have spent on the Copilot this month against their budget. It does not show their chats.
ADVISORY
You cannot remove yourself or change your own role from this page. A person can always delete their own account from the Account page.
9.2 What a team member sees
A team member who opens Team sees a page with no controls. It says "You are part of <team>.", names the Captain ("Your Captain is <name> (<address>)."), and lists What you can use: each connector as Not enabled, Read only or Read and write. Under it: "Ask your Captain if you need another connector." A person who is not in a team who opens /app/team is told "You are not part of a team."
On the Connectors page, a connector set to Not enabled shows as not enabled by the Captain, with no Connect button.
9.3 The team door: Sign in to a team
ARRIVING · Only for teams, switched on per customer
The line described here appears on the sign-in page only on a build with Teams switched on. On any other build the sign-in page is exactly as chapter 4 describes, with no extra line.
Open the sign-in page. Under the Google button, press the quiet line Sign in to a team.
You should see The same page changes: it says "Use the email address your Captain invited and your password." and shows only an email and password form. There is no Google button and no sign-up link.
Type your email address and your password and sign in.
You should see The console opens. If you have forgotten the password, the reset link is inside the form.
To go back, press Sign in with Google instead.
A new member's first visit is the link in the invitation email. That page says "Choose a password to join your team." After that, use the team door each time.
ADVISORY · In the Mac and Windows apps
On the sign-in screen of the app, press Sign in to a team, then Enter Cockpit. Your browser opens the team door, and once you have signed in it hands you back to the app.
9.4 What the Captain controls
For each member and each connector (Salesforce, MuleSoft, Slack, GitHub, Postman, and the Workstation, which is not available today) the Captain sets a level:
| Level | Meaning |
|---|---|
| None | The connector is not available to that person. It shows as not enabled by the Captain, with no Connect button, and the Copilot has none of its tools. |
| Read | The person can connect it and the Copilot can read it. No write action is offered, whatever the mode. |
| Write | As Read, plus the write actions, if the person is in Production mode and approves each card. |
Presets save time: Everything (read and write), Salesforce only, Salesforce and MuleSoft, or Nothing yet when you invite, and any combination of connectors afterwards (9.1).
ADVISORY · The smaller of two limits
A member's power is the smaller of the Captain's level and the member's own mode. A member with Salesforce at Read, in Production mode, can read Salesforce and cannot write. This is enforced on the server, at every place a connector is reachable, and a failure to look up the grant means no access.
9.5 What the Captain sees, and does not
| The Captain can see | The Captain cannot see |
|---|---|
| Who is on the team, their role and access, and whether each has connected each provider. | A member's chats or messages. |
| An activity log: who, when, which connector and which action (for example a tool call, an approval decision, a mode change). | The input of a tool call, or what the Copilot answered. |
| Each member's monthly AI spend against their budget. | A member's tokens, secrets or connections. |
| A log of team changes: invited, joined, access changed (before and after), removed. | A member's approval cards. |
ARRIVING · Not on the team page yet
The brain records the team's activity and the log of team changes, but the team page in this edition shows neither. What the team page does show is in 9.1: who is in, their role, their access, what they have connected and their monthly Copilot spend.
Connections, chats, the Workstation and the AI budget are per member. Nothing is shared in the first version. A write that a member approves is attributable twice: to their approval in Cockpit, and to their own login in the customer's system.
ADVISORY
A member approves their own writes. The Captain decides whether a member can write at all, by the level. A rule that the Captain must approve members' writes is a possible later option, only if a customer asks for it.
9.6 Removing a person
- Removal cuts the person off at once: their access, runner tokens, connections (revoked where the provider allows) and running tasks.
- Their data is kept invisible for a 30-day grace period and then purged, or purged at once if the Captain chooses.
- A person can always delete their own account, whether Crew or Captain. If the last Captain deletes their account, the team is suspended and the Cockpit owner is told.
9.7 Planning for a team of six
Plan a team checklist
- Decide who will be the Captain.
- List each person's work email address. Each person needs an address that is not already an individual Cockpit account.
- For each person, choose None, Read or Write for Salesforce, MuleSoft, Slack, GitHub and Postman.
- Decide whether the Captain wants any member in Sandbox only. Each member's mode is their own.
- Decide whether anyone's retention needs (a longer hold, an export) differ from the 30-day grace period, and tell the owner before launch.
Pricing for teams is by quotation: ask support@cockpitai.io. Online payment is not available.