IAM & Organizations - Hexel Studio

IAM controls who can access Hexel Studio, what they can do, and how resources are isolated across your organization. Members, roles, environments, and credentials are all governed here — set it up correctly once and it protects everything downstream.

Why IAM matters for multi-team setups

Concern	How IAM addresses it
Blast radius	Credentials scope to a single workspace + environment. A compromised staging key cannot touch production resources.
Billing attribution	Usage records roll up per environment, so you can attribute cost to the team or project that incurred it.
Compliance	RBAC permissions follow the `data-platform:<resource>:<action>` / `orchestrator:task:write` pattern, giving auditors a clear map of who can do what.

In this section

Environments

Isolated contexts for production, staging, and development.

Members & Roles

People in your organization and what they can do.

API Keys

Credentials for development and scripts.

Service Accounts

OAuth clients for production services.

Resource hierarchy

Resources are scoped across three levels:

Organization → Workspace → Environment

Organization — members, billing, and roles.
Workspace — a project or team grouping.
Environment — an isolated context where resources live (production, staging, development).

See Organizations for the full model.

How you manage it

Members, roles, service users, API keys, and OAuth clients are managed in the Console under IAM. Credentials are scoped to a workspace and environment, and every API request is authorized against the identity behind the token.

Next steps

Start with Environments, or jump to API Keys to create your first credential.

​Why IAM matters for multi-team setups

​In this section