Organizations & Role-Based Access Control (RBAC)

Learn how to manage team members, assign granular permissions, and track administrative actions across your infrastructure.

1. Multi-Tenant Organization Structure

In TurboV, all infrastructure resources (servers, applications, databases, and backup configurations) belong to an Organization:

  • Personal Organizations: Created automatically for each user upon initial sign-up. Ideal for side projects and personal experiments.
  • Team Organizations: Multi-user workspaces designed for startups, enterprise engineering teams, and agencies.

You can create unlimited organizations and switch between them instantly using the Organization Switcher in the top navigation bar.

2. Role-Based Access Control (RBAC) Permissions Matrix

TurboV enforces strict Role-Based Access Control across all API endpoints and dashboard actions:

Action / CapabilityOWNERADMINMEMBERVIEWER
Billing & Subscription Management✅❌❌❌
Delete Organization✅❌❌❌
Manage Team Members & Invites✅✅❌❌
Add & Remove Servers✅✅❌❌
Create & Manage API Keys✅✅❌❌
Configure Backup Storage Providers✅✅❌❌
Deploy & Manage Applications✅✅✅❌
Provision & Clone Databases✅✅✅❌
Run Commands via App Commander✅✅❌❌
View Dashboards, Logs & Metrics✅✅✅✅

3. Inviting Team Members

To add collaborators to your organization:

  1. Open Settings → Team Members.
  2. Click Invite Member.
  3. Enter their email address and select their role (ADMIN, MEMBER, or VIEWER).
  4. Click Send Invitation.

TurboV generates a cryptographically secure, tokenized invitation link. The recipient clicks the link to accept and immediately joins your organization workspace.

4. Organization Audit Logs

Security and compliance require visibility into every administrative action:

  1. Navigate to Settings → Audit Logs.
  2. Review the append-only audit trail capturing:
    • Timestamp: Exact UTC time of the action.
    • Actor: User name, email, and avatar.
    • Action: Event name (e.g. server.create, deployment.rollback, database.clone, env_var.update, member.invite).
    • Resource: Target application, server, or database ID.
    • IP Address: Originating IP address of the user.

Audit logs cannot be edited or deleted by team members, providing an immutable record for security reviews.