DocsBook a demo

Platform

Platform overviewArchitectureWorkflow orchestrationGitOps configurationGovernance and AAAAI and MCPKnowledge and contextRuntime and executionEvidence and monitoring

Use cases

All use casesProduction incidentRelease preparationHotfix to productionSecurity scan triage
Why NopsAIIntegrationsSecurity

Resources

All resourcesAI agent governanceMCP governanceMCP securitySelf-hosted platforms
PricingGitHub

Company

How a run worksAboutContactBook a demo

Teams and resource ownership

Team paths are the ownership boundary for access, notifications, and GitOps authority.

ConceptAdministratorSecurity

Key points

  • Product team paths are canonical. Team sync and OIDC team_mapping mirror those paths into AAA auth-team subjects.
  • Pipelines, reusable steps, schedules, scopes, and Knowledge Context expose a selectable global bucket for resources without a concrete team path.
  • root and general are not accepted aliases for global.
  • All teams is an aggregate filter only and must never be persisted as the resource owner.
  • Mapped SSO teams get viewer access to the matching product team path when it exists, unless a stronger basic_role_mapping is configured.
  • Team-scoped create authorization works before any resource row exists.

How it works

Create preflight that depends on manifest ownership can pass team_path or run_team_path to GET /v1/access/effective-permissions. That is how an inherited team owner creates the first schedule, trigger, external trigger, webhook source, or scope under their team without a seed resource.

Teams can own applications, configuration repository bindings, notification routes, defaults, and their own LLM, Agent, and MCP profiles.

Run ownership comes from run_team_path on the entry point, which is what drives notification lineage and Pipeline Runs grouping.

Examples

Read the ownership treebash
curl -s -H "Authorization: Bearer $NOPSAI_TOKEN" "$NOPSAI_URL/v1/teams" | jq '.[] | {id, path}'
curl -s -H "Authorization: Bearer $NOPSAI_TOKEN" "$NOPSAI_URL/v1/teams/$TEAM_ID/applications" | jq
Result

Team paths are the ownership boundary every other resource refers to, so this tree is what access, notification, and GitOps authority hang off.

Implementation evidence

  • doc/team-resource-ownership-design.md

    Separation of Teams from Pipeline Runs and team-scoped profiles.

  • services/nopsai/routes.go

    Team, application, defaults, and profile routes.