Who can see what
Two roles
| Member (user) | Admin | |
|---|---|---|
| Their own sessions, tasks, usage, clients | Sees and manages | Sees and manages |
| Other people's sessions | Cannot see | Sees the list ("All sessions"), not the content |
| Subscription pool, subscription access | Cannot see; sees only their own personal limit | Adds, pauses, removes, grants |
| Per-person quota | Sees only their own | Sees everyone's and sets it |
| Users list, invites | — | Adds, removes, sends invites |
| Machines, join codes, maintenance | Sees only the ones they have an account on | All |
| Settings, audit | — | All |
A member who opens an admin page (including any address under /admin and old bookmarks) sees exactly what an address that does not exist shows — "page not found" (404) — and the attempt is recorded in the audit. On the everyday pages (Overview, Sessions, My usage) an admin, like a member, sees only their own; everyone's is in the Admin group.
What an admin can and cannot see
Can see (All sessions, Usage by person): whose each session is, which machine it is on, which subscription it uses, its state, how many tokens it used, and which task it is doing.
Cannot see: what was said in a session or what code it changed. No page and no endpoint on the hub can read a session's content; session transcripts exist only in the member's own account on the machine, and the accounts on a machine cannot read one another.
One thing to be clear about: a machine's root (its system administrator) can technically read any account's files on that machine. When self-hosted, that is your own machine administrator; when hosted, it is us. The home directory archived when an account is removed is also on the machine (Creating and removing accounts).
What an admin can and cannot do
Can:
- invite people, remove people, take back their account on a machine
- add subscriptions, decide who may use which subscription, set each person's limit
- see everyone's usage and session list, read the audit
- self-hosted: add machines, put one in maintenance, remove machines, change the hub's settings
Cannot:
- read anyone else's session content from the hub
- get a subscription's long-lived credential: once stored in the hub, neither the web nor the command line shows it to anyone again
- add or remove admins on the web: admins are written only in the hub's deployment configuration (Admin handbook)
- hosted: sign in to the machines or change them (we do that)
Audit
The console's Admin → Audit: who did what and when over the last 60 days — adding and removing people, sending invites, creating and removing accounts, adding subscriptions, changing access and quota, maintenance, changing settings, refused attempts to reach what one may not. Filter by subscription · service node · client · user · settings · session, or Export CSV.
Members' clients
Each of a person's computers and phones is a "client". On the Service nodes & clients page, the "Clients" tab lists everyone's clients, and an admin can revoke any one of them (say a member lost their phone). A revoked client cannot connect from that moment; the member signs in again on it. Removing a user revokes all their clients at once.
How credentials are kept and how long they last: Security and isolation.