Nuphos controls access in three layers. Together they answer: who is this
person, which accounts may they use, and what can the agent do right now?
1. Team roles
Every member has a role — Administrator, Editor,
or Viewer — that sets their baseline. Only Administrators can connect or
remove accounts and manage members.
2. Member allow-lists on a binding
When an account is connected, an Administrator can restrict it to specific team
members with a per-binding allow-list. By default, binding an account grants
access to the person who connected it; the allow-list is how you widen or narrow
that.
This is enforced on every credential request: even if the agent has an account
selected, Nuphos re-checks that the requesting user is allowed to use it before
handing over credentials.
Use allow-lists to keep production accounts to a small group while letting the
whole team work with staging.
3. Per-session credential selection
Within a session, the agent only ever has the credentials you explicitly
selected for that session — and only for accounts you’re allowed to use. The
agent can’t reach into an account you didn’t hand it. See
Agent sessions.
Why this matters
These layers compose into least-privilege by default: a Viewer can’t change
anything, a member can only use the accounts they’re on the allow-list for, and
each session is scoped to exactly the credentials it needs. The credentials
themselves are short-lived — see the IAM trust model.
For control over changes specifically — approvals and audit — see
Approvals & audit. 
