IAM, Members, Teams, and Roles

Verdictan uses four resource types for access control:

Resource	Responsibility
User	Organization membership, invitation state, and account lifecycle
Team	A group of organization members and a scope for team-level access
Role	An assignment for a user or team that you can reuse
IAM policy	One or more allow/deny statements attached to roles

Use this access-control path: policy → role → team or user. Prefer team assignments for shared job functions. Use direct user assignments only when the documentation records an approved cause.

Before you change access

Authenticate the CLI. Then make sure that the target identity and region are correct:

verdictan auth whoami
verdictan regions current

List the active resources:

verdictan iam policy list
verdictan role list
verdictan team list
verdictan user list

API-backed IAM commands support --profile, --region, --api-url, and --config. Do not put a token in shell history. Authenticate with a signed-in profile or VERDICTAN_API_TOKEN.

Create a minimum-privilege role

Create a policy for reuse:

verdictan iam policy create \
  --name "Evidence Reader" \
  --description "Read governance events and exported evidence" \
  --effect allow \
  --action events:read \
  --action exports:read \
  --resource '*'

You must include one or more --action flags and one or more --resource flags. Use an applicable flag for each value in the statement. Use --conditions-json only with reviewed JSON conditions.

Create a role. Attach the policy:

verdictan role create \
  --name "Evidence Reviewer" \
  --description "Reviews events and evidence exports"

verdictan role attach-policy \
  --role-id role_example \
  --policy-id policy_example

Examine the role actions and assignments:

verdictan role show-actions --role-id role_example
verdictan role show-assignments --role-id role_example

Use the Permissions Reference for documented public action names. A wildcard resource is broad. If a narrower scope is available, replace '*' with reviewed VDT patterns.

Invite and manage members

Invite a member with an organization-level role:

verdictan user invite \
  --email reviewer@example.com \
  --role-id role_example \
  --assignment-level org

For a team-level invitation, specify the team as the assignment target:

verdictan user invite \
  --email analyst@example.com \
  --role-id role_example \
  --assignment-level team \
  --assignment-target-id team_example

Member lifecycle commands include:

verdictan user get --user-id user_example
verdictan user update --user-id user_example --name "Alex Reviewer"
verdictan user suspend --user-id user_example --yes
verdictan user reactivate --user-id user_example
verdictan user remove-membership --user-id user_example --yes

If access removal is temporary, use suspension. Membership removal is destructive. Before you remove membership, examine owned tokens, team membership, open work, usage attribution, and evidence ownership.

Direct role assignment supports organization and team scope:

verdictan user assign-role \
  --user-id user_example \
  --role-id role_example \
  --assignment-level org

For --assignment-level team, add --assignment-target-id team_example. Detaching a role uses the same scope fields. You must acknowledge the detachment with --yes.

Create and manage teams

verdictan team create \
  --name "Security Review" \
  --description "Governance evidence reviewers"

verdictan team add-member \
  --team-id team_example \
  --email reviewer@example.com

verdictan team assign-role \
  --team-id team_example \
  --role-id role_example

Review effective membership:

verdictan team get --team-id team_example
verdictan team list-members --team-id team_example

You must acknowledge member removal and role detachment with --yes:

verdictan team remove-member \
  --team-id team_example \
  --user-id user_example \
  --yes

verdictan team detach-role \
  --team-id team_example \
  --role-id role_example \
  --yes

A team deletion does not remove each permission from its members. Examine direct user assignments and memberships in other teams.

Change and remove policies safely

Before update or delete, use get:

verdictan iam policy get --policy-id policy_example --json
verdictan role show-assignments --role-id role_example --json

Recommended removal sequence:

Identify each user and team assignment.
Make sure that an alternative access path is available where necessary.
Detach the role from users and teams.
Detach the policy from the role with verdictan role detach-policy ... --yes.
Delete a role or policy that has no assignment. Use its command's --yes flag.
Verify with the list, action, and assignment commands.
Review the resulting Trail records.

An access change can immediately change console, CLI, API, and token workflows. Test with a non-owner account that has the specified role. Owner access can hide missing grants.

Command inventory

Family	Commands
Policies	`verdictan iam policy list/get/create/update/delete`
Roles	`verdictan role list/get/create/update/delete/attach-policy/detach-policy/show-actions/show-assignments`
Users	`verdictan user list/get/invite/update/suspend/reactivate/remove-membership/assign-role/detach-role`
Teams	`verdictan team list/get/create/update/delete/add-member/remove-member/assign-role/detach-role/list-members`

Use --json for commands that support machine-readable automation. Use the exit status as the success signal.

Before you change access​

Create a minimum-privilege role​

Invite and manage members​

Create and manage teams​

Change and remove policies safely​

Command inventory​

Next steps​