# Team

> People, roles, the team hierarchy that owns services and approves fixes, who may sign in, and passwords for the rare person who can't receive a code.

Source: https://docs.3am.si/console/team · Markdown: https://docs.3am.si/console/team.md · All docs: https://docs.3am.si/llms.txt
3AM is an on-prem AI on-call engineer for regulated enterprises (https://3am.si).

**Team** (`/team`, `g m`, also open during setup) manages who can sign in and what each may do. Admins and owners
manage everyone; a team's lead manages that team and the teams under it.

## People

Add a person by e-mail with a role. People from your directory (single sign-on with groups) are managed by it: their
role, teams and tags follow their groups and show a *directory* tag ([Single sign-on](https://docs.3am.si/access/sso)).

| Role        | May                                                                                                                                                                                                                      |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `viewer`    | See incidents, approvals, the digest, the estate, the audit log, connections (never secrets), the policy, Doctor, the Keychain and installs; export                                                                      |
| `responder` | + halt 3AM, withdraw an approval request, record what the team did; asked to approve fixes on their teams' services                                                                                                      |
| `admin`     | + connections, policy and escalation, raising autonomy (approved by others), fix mode, resume, estate, discovery and Study, learned patterns, branding, sign-in and mail, the Keychain and installs, the business report |
| `owner`     | + the licence, making people admins or owners, passwords, taking over as the Keychain's home                                                                                                                             |

Full detail: [Roles](https://docs.3am.si/access/roles). The last owner can't be demoted, disabled or removed.

## Teams

Teams form a hierarchy: a team may sit under a parent, has a **lead** and **members**, and **owns services**. When
policy names no approvers for a service, 3AM asks the team that owns it: its responders, then its lead, then the leads
above. People are reached on their **handles** per channel (`{"chat": "U123", "pager": …, "phone": …}`).
[Teams](https://docs.3am.si/access/roles#teams).

## Who may sign in

Allowed domains (a new install starts with the first owner's), blocked domains and addresses, block public webmail,
and 85 known disposable-mail domains always refused. Tightening the rules signs out everyone now outside them, at once
([Sign-in rules](https://docs.3am.si/access/sign-in#who-may-sign-in)).

## A password, for one person

For a reviewer, an auditor or a guest who can't receive a code: an owner gives a password (12+ characters) that ends
after 7, 30 (default) or 90 days, or never. Never for an owner or directory people ([Passwords](https://docs.3am.si/access/sign-in#a-password-for-one-person)).