Permissions & access

Namespaces, the five access levels and what each allows in development, staging and production, and how admins manage the team.

Admin Updated 11/12/2026

Admins. Managing the team is an admin task. What each level allows is useful for everyone.

Namespaces

A namespace is your workspace on CloudWady. It holds your projects, servers, backups, team and billing. Everyone you add to it gets an access level in it, and that level decides what they can see and do there.

The top bar always shows the namespace you are working in. When you belong to more than one, click it to open the switcher:

Click a name to work in that namespace alone.
Tick the boxes next to several names to see them together.
Click the icon to work in a namespace and every client namespace below it.

Each row shows how many projects the namespace holds. A Sandbox badge marks the shared demo you see after signing up, and Pending marks a namespace CloudWady has not reviewed yet.

The namespace switcher open in the top bar, listing two namespaces — The namespace switcher: click a name, tick several, or include the client namespaces below one.

Client namespaces

A client namespace keeps one client of an agency apart, below the agency's namespace, with its own projects, members and billing.

You can

Add one with Add Client Namespace on Overview, while you work in the agency's namespace alone.
Fill in at least the Client Name and Client Contact Email, which are required.
Press Create & Open Client: the namespace is created below yours, with no review to wait for, and the dashboard switches to it.
Choose a plan for its first project there (Create a project).

Good to know

Only an Admin sees the button, in a namespace with an active White Label add-on, outside the Sandbox.
The button is enabled once one of that namespace's projects is approved and on a paid plan. Until then, hover it to see why.
The name must not be in use anywhere on CloudWady.
The agency's members reach it with the same level, shown as Inherited in Team & Access. A level given on the client namespace itself wins.
Your first namespace is created from the Sandbox instead: see Your namespace.

Namespace settings

The settings of the namespace you are working in: its brand, the key that signs your backup download links, and the extra ports your servers open.

You can

Set your brand under White Label, Brand Identity, Theme Colors and Brand Assets.
Regenerate the backup key under Backup Secret Key, and open more ports under Firewall.
Press Save at the bottom to keep your changes, or Discard to drop them.

Good to know

Pick one namespace in the switcher first. With several in play, the page asks you to choose one.
Only what you changed is sent. After a save, the dashboard reloads to show the new brand.
Maintainers and Admins can open the page. Only Admins can save it, regenerate the key or firewall all servers.
The brand sections show only while the namespace has the White Label add-on.

White Label

Whether this namespace has the White Label add-on, which lets your own brand replace CloudWady's.

You can

Read Active to see whether the add-on is on. You cannot switch it here.
Press Manage Add-ons while it is off: it opens Billing & Plans, where an Admin adds it in the add-ons at the top.

Good to know

Active turns on when the add-on starts and off when it ends (White Label).
The brand sections stay hidden until the add-on is active.
Your brand then replaces CloudWady's for everyone working in this namespace: in the dashboard, the alert emails and your apps' maintenance pages.
A client namespace with no logo of its own shows the brand of the nearest namespace above it that has one, with the client's name beside it.

Brand Identity

The name, link and contact address your users see in place of CloudWady's.

You can

Turn on Use Title to show a name beside your sidebar logo, and write it in Title.
Set the site the sidebar logo opens in Website URL.
Set the contact shown on your apps' maintenance and access-blocked pages, and in the alert emails, in Support Email.

Good to know

An empty title shows the namespace's name, and an empty website URL keeps the logo's usual link.
Without a support email, the namespace's contact email is used. With neither, the pages show no contact line.
The dashboard shows a change once you save.
An app's maintenance page takes a new support email only at the app's next Deploy, Update or Update Config (Maintenance).
Changing these takes the Admin role.

Theme Colors

The colors your brand gives the dashboard and the alert emails.

You can

Click a palette under Color Presets to fill in all seven colors at once.
Fine-tune any color under Brand Colors with its picker.

Good to know

Changing any color switches the preset to Custom, which keeps the colors as you set them.
Nothing changes until you save. The dashboard then reloads in the new colors.
The alert emails sent under your brand use the new colors too.
Changing colors takes the Admin role.

Brand Assets

Your logos and favicon, each previewed on the background it is shown against.

You can

Pick a file with a tile's camera button, or remove the current one with its bin.
Upload the Logo — light theme as PNG, JPG or SVG. About 64×64 pixels shows best.
Add a Logo — dark theme for dark mode, if you want one.
Set the color behind each logo with its Background.
Upload the Favicon, the browser tab's icon, as ICO or PNG at 16×16 or 32×32 pixels.

Good to know

The files are stored only when you click Save.
The light logo is also used in the alert emails, and in dark mode when there is no dark logo.
Without a logo, the sidebar keeps CloudWady's, and a client namespace below yours does not take your brand.
Changing the assets takes the Admin role.

Backup Secret Key

The key that signs the download links of every backup in this namespace.

You can

Press Regenerate Key to make a new key and write it to every deployed server of the namespace at once.
Read the new key: it shows once, in plain text, until you reload the page.
Check the message that follows: it lists the servers that took the key and any that failed.

Good to know

Every app of the namespace uses this key, and each of its servers holds a copy.
Regenerating stops every download link made before. Make a new one with More › New Download Link on the backup (The backup list).
Regenerating cannot be undone, and it takes the Admin role.

Firewall

Which extra ports every server of this namespace opens, beyond 22, 80 and 443, which are always open.

You can

Open more ports on every server with Additional Ports, as a comma-separated list such as 8069, 8072.
Apply a saved change now with Firewall All Servers: it runs Harden Server on every deployed server of the namespace.
Follow each of those runs under that server's Operations.

Good to know

Otherwise a saved change reaches a server only when its firewall is applied: at its Deploy and Update, and with Harden Server (Server actions).
Allowed IPs is shown, but you cannot set it: limiting access to some addresses is turned off.
Changing the ports and Firewall All Servers take the Admin role.
Firewall All Servers needs at least one deployed server in the namespace.

Access levels

There are five levels. Each includes everything the levels above it in this table can do.

Level	What it allows
Viewer	Sees the namespace's projects, apps, servers, backups and logs. Changes nothing.
Developer	Works on development: creates, deploys, updates, backs up, restores, retries and deletes development apps.
Developer Plus	Does the same on staging, and opens a terminal on servers that host no production app.
Maintainer	Runs production: deploys, updates, backs up, restores and retries production apps, and deletes production backups. Creates environments, opens a terminal on production servers, and manages alert rules, channels and maintenance windows. Opens Infrastructure (servers, storage, installers), Integrations (cloud providers, domains, Git providers), Billing & Plans and the namespace settings.
Admin	Everything in the namespace. That includes projects, Team & Access, plans, seats and add-ons, client namespaces, and deleting production apps and environments.

By environment

What you may do to an app depends on the environment it runs in. The same rule applies in the dashboard, the API, cw and AI assistants.

Action	Development	Staging	Production
Deploy, update, update modules, back up, restore, retry, restart, maintenance	Developer	Developer Plus	Maintainer
Delete an app	Developer	Developer Plus	Admin
Delete a backup	Developer	Developer Plus	Maintainer
Open a terminal on the app's server	Developer Plus		Maintainer

A server that hosts a production app counts as production for the terminal, whatever else runs on it.

Team & Access

Who works in your namespace and in the client namespaces below it, at which level, and how many seats they use.

You can

Add someone with Add member on the namespace's row (Add a member).
Buy seats with Add seats on the namespace's row (Seats).
Change a member's level right in their row (Change a level).
Take someone off the namespace with Deactivate (Deactivate a member).
Open a member's details with the arrow at the start of their row: notification settings, last sign-in, where their access comes from, other namespaces.

Good to know

The Inherited and Deactivated filters show the members hidden by default: access from a parent namespace, and people you took off.
A namespace you belong to but do not administer is marked View only.
The search box at the top of the screen searches every namespace in the tree.
Team & Access is for Admins.

Team & Access: a namespace with its seat meter and its members, each with a level — The seat meter, **Add seats** and **Add member** for this namespace.

Each member's level. Change it right there.

**Inherited** and **Deactivated** show the members you don't see by default.

A member's row opened, showing notification scope, severity, last sign-in and other namespaces — A member's details: notification settings, last sign-in, and their other namespaces.

Add a member

Click Add member on the namespace's row. Then choose one:

Select Existing User for someone who already has a CloudWady account;
Create New User for anyone else. Enter their name, login and email. Leave the password empty and they get an email to set their own.

Pick their Access Level and confirm. If you typed a password instead (the key button generates one), pass it on to the person in a safe way; they can change it under My Settings Profile.

The add member dialog with name, login, email, password and access level — Adding a member: an existing account, or a new one with its level.

Every active member of a namespace uses one of its seats. Members who only inherit access from a parent namespace use none here. If the namespace has no free seat, CloudWady refuses to add the member: add seats or move a project to a plan with more of them.

Change a level

Pick a new level in the member's row; it applies straight away. An admin can give any level in the namespaces they administer, Admin included. An inherited member's level is changed in the namespace it comes from.

Lowering a level also removes SSH access the new level does not allow:

Down to Developer: the member's SSH keys on servers that host production apps are removed.
Down to Viewer: all their SSH keys on the namespace's servers are removed.

A namespace always keeps at least one admin of its own. The last one can't lower their own level or deactivate themselves. Make someone else Admin first.

Deactivate a member

Deactivate takes the person off this namespace. Their SSH keys on its servers are removed, and their seat is freed. Their access to any other namespace stays as it was. The Deactivated filter lists them, with a Restore button to bring them back.

A member marked Account disabled can't sign in anywhere on CloudWady. Contact support if you think that is a mistake.

Notification settings

Each membership has its own notification settings. Open a member's row to see them. You can change your own, and an admin can change anyone's in the namespaces they administer.

Setting	What it does
Scope	Whose deployments this person hears about: None, Own (only their own deployments) or All.
Severity	The lowest severity that reaches them: Info, Warning or Critical.
Follows deployments in chatter	Follows the deployments in their scope, so the activity notes on them reach this person.

What each alert is and where it is sent is covered in Alerts & notifications.

Account review

CloudWady reviews new sign-ups. Until then, the member's row shows Pending review. A pending account works normally. A Rejected account can't sign in. You don't need to do anything about either. Contact support with any question.

Was this page helpful?

Your answer helps us prioritize documentation improvements.