Teams and access

​

Membership

Access follows team membership. Someone who joins a team can query every datasource that team owns; removing them revokes it immediately, in-flight sessions included. If two groups need different slices of the same database, give them separate teams and separate datasources with different exposure rules. One shared team with a compromise exposure serves neither group well.

​

Adding people

Invite by email from team settings. Invitations are scoped to a single team.

​

What an agent inherits

An agent acts as the person who authorized it — exactly the teams and datasources that account can reach, and nothing more. It cannot connect a database, change what’s exposed, or grant itself more access. For non-browser clients, API keys narrow this further with scopes.

​

Removing access

The last one is worth knowing you have. Because the credential is yours and TeamDuo never created it, you can end access from your side without waiting on anyone.

​

Auditing

Every query is recorded with the datasource, the actor, the statement, the row count, and the duration — never a cell of your data. Review the log when you widen exposure, so you can see what the new surface is actually used for.