Add a teammate

Don't share your invite link or your session cookie. Mint a new invite for them — costs you ~5 seconds.

ssh ubuntu@kilasec.com
cd /opt/agentfw && . .venv/bin/activate
python -m cloud.admin_cli invites create <tenant-id> \
  --label "for alice@acme.com" --ttl-hours 72

Send the printed URL to them via Signal / email / 1Password Secure Send. They click → set their own session cookie → they're in. The URL is single-use; they can't reshare.

If they ever leave or you want to cut their access, list their sessions and revoke:

python -m cloud.admin_cli sessions list <tenant-id>
python -m cloud.admin_cli sessions revoke <session-id>

(Sessions admin is part of the cloud admin CLI; the SPA has a User Settings page that does the same.)

For role-based access (admin vs. read-only vs. compliance-officer), see Users & Roles — currently a placeholder on the Admin nav, with proper RBAC landing in v0.5.