Best practices
Manage ownership and access
Keep secret responsibilities and organization roles aligned as people join, move or leave.
Why review ownership and access together?
The person who created a key may no longer operate the service. Assignment identifies who should handle remediation. Organization roles determine which actions they can take. Removing an account does not revoke keys that person used.
Recommended responsibilities
Assign each reviewed secret to someone who understands the service and its environment. Use the code author as a starting point for finding the current owner. Confirm who operates the service today. Hand over outstanding remediation work and known consumers when responsibility changes.
| Role | Recommended responsibility |
|---|---|
| Owner | Take responsibility for organization ownership and owner-only settings. Identify a successor before an absence or departure. |
| Admin | Give this role to people who manage integrations, alerts and membership. Do not grant this role solely for routine secret remediation. |
| Member | Use this role for people doing day-to-day review and remediation. Check the assignment and sharing policy to determine whether they can edit a particular secret. |
Review roles under Settings › Members and teams. Use Roles and permissions to check allowed actions. Access to a menu does not imply permission to change every secret it contains.
When someone leaves or changes teams, review Unassigned and Inactive owners' keys in Owners. Assign a new owner. Assess which keys need replacement or revocation. Review team access before completing the account cleanup.
Common mistakes
Promoting everyone to administrator to solve an access problem also expands who can change integrations and membership. Check the required task and the secret's assignment first. Deactivating a directory account does not establish whether its keys still work. Check key validity and service usage separately.
Checklist
- Identify the current person responsible for each service.
- Limit administrative roles to people who need them.
- Review unassigned secrets and secrets linked to inactive owners.
- Give successors the known consumers and outstanding work.
- Establish a handover procedure for the organization owner.