Team Management

Team management shows the current Clerk organization roster and controls ticket assignment mode. Clerk membership-role mutation is suspended in Keva until current-authority, provider-result, and durable audit reconciliation exist.

Overview

Keva uses organization membership powered by Clerk. The current Team screen distinguishes two Clerk roles, Admin and Member. These are separate from Keva's tenant RBAC roles and permissions.

Current Product Boundary

The current Settings > Team screen does not provide controls to:

• invite or remove organization members
• change Clerk Admin/Member membership roles
• assign Owner, Admin, Agent, Viewer, or custom Keva tenant RBAC roles

The current Settings > General screen includes an invitation section for authorized users with team.invite:

• invite teammates by email and select an available Keva role
• view pending invitations
• revoke pending invitations after confirmation

Organization-member removal and Clerk membership-role changes remain outside this screen and must currently be handled through an approved Clerk administrative process.

Managing Team Members

View Team Members

The Team page shows all members with:

• Name and email
• Profile image when available
• Read-only Clerk organization role

Keva checks team.view before contacting Clerk and checks current team.view again after the complete Clerk roster has been read. The roster is returned only when that second check still authorizes the actor and the exact Clerk organization still maps to the same Keva tenant. This is a local response-release boundary; it does not make Clerk's multi-page roster read an atomic provider snapshot.

Change Ticket Assignment Mode

Authorized administrators can select Manual, Round Robin, or Least Busy on the Team screen. This controls the tenant's ticket assignment mode; it is not a member-role change. Selecting the already-active mode makes no change and creates no change event. A stored transition and its minimized audit event commit together.

Permission Requirements

Action	Required Permission
View team list	team.view
Invite teammates	team.invite
Revoke pending invitations	team.invite
Change ticket assignment mode	settings.edit

The suspended Clerk membership-role endpoint retains team.edit_roles as its outer authorization boundary, then returns a stable unavailable response before target resolution, body validation, Clerk access, route-owned tenant or mutation work, or audit work. Permission resolution may read Keva's RBAC storage.

Two Separate Role Layers

Clerk organization membership uses:

Role	Description
Admin	Clerk organization administrator
Member	Clerk organization member

Keva separately defines Owner, Admin, Agent, Viewer, and custom tenant RBAC roles. The current Team screen does not assign those roles. See Roles & Permissions for their permission definitions.

Best Practices

Principle of Least Privilege

Grant Clerk Admin only where organization administration is required. Define least-privilege Keva tenant roles separately and reconcile their assignments through an approved administrative process until a supported assignment UI exists.

Regular Access Reviews

For SOC 2 compliance, review team access quarterly:

1. Check if all members still need access
2. Verify Clerk and Keva tenant roles are appropriate
3. Remove inactive users through the approved Clerk process
4. Document the review

Offboarding Checklist

When a team member leaves:

1. Remove them through the approved Clerk process
2. Rotate any API keys they created
3. Review their recent activity in audit logs
4. Update any shared credentials

Audit Trail

Stored Team transitions emit:

• team.assignment_mode_changed - Ticket assignment mode changed atomically; an identical request is a no-op and emits no change event

This does not claim Clerk invitation, removal, membership-role mutation, provider/audit reconciliation, or complete Team audit coverage.