Roles, permissions, groups
Control who can do what with system roles, fine-grained permissions, and custom groups.
- Open the RBAC admin area.
- Assign each user a system role as their baseline level of access.
- Grant or restrict fine-grained permissions to shape exactly which actions and surfaces are available.
- Create custom groups to bundle permissions for a team and assign users to them.
- Remember that sensitive actions are gated at the API layer, not only in the UI.
Audit Log
An admin-only timeline of state changes across the platform, aggregated from existing tables.
- Open the Audit Log (gated by the RBAC admin permission).
- Review deploys, PR merges, and reviews.
- Review group membership changes and credential writes.
- Use it to attribute high-impact actions, including any force-merge overrides, to a person and time.
Credentials Vault
Encrypted storage for AI provider keys, OAuth tokens, and cloud credentials. Bring your own AI, stored safely.
- Add a credential (an AI key, integration token, or AWS key pair) through the vault.
- The secret is encrypted at the application layer with AES-256-GCM before it is stored.
- Secrets are decrypted only at the moment a request needs them, and are never shown in plaintext in the UI.
- Rotate a credential in place without dropping existing connections.
Add a user
Invite a teammate by email during the closed beta. The invite link is time-limited.
- As an admin, mint an invite for the teammate, optionally binding it to their email.
- RuneSpoke sends the invite through AWS SES.
- The teammate follows the link to create their account. The link expires after seven days.
- Assign them a role and any groups in the RBAC admin area once they join.