Team Rollout

This guide covers everything an engineering manager needs to plan team adoption of TameFlare: multi-environment setup, RBAC, user management, and onboarding.

Multi-environment setup

Create separate gateways in the dashboard for each environment. Each gateway has its own connectors, credentials, and permissions.

GatewayEnvironmentConnectorsEnforcement
dev-botDevelopmentGitHub (allow all), OpenAI (allow all)Monitor
staging-agentStagingGitHub (read only), OpenAI (allow)Soft enforce
prod-agentProductionGitHub (require approval for writes), Stripe (deny deletes)Full enforce

Why separate gateways

  • Isolation - a misconfigured permission in dev cannot affect production
  • Independent kill switches - you can kill-switch one gateway without touching others
  • Different credentials - each gateway uses its own API tokens
  • Gradual rollout - start with monitor mode in dev, enforce in production

Each developer initializes with the appropriate gateway, then runs their agent:

tf init --list          # Pick dev-bot, staging-agent, or prod-agent
tf run -- python my_agent.py

RBAC (Role-Based Access Control)

TameFlare has 4 fixed roles in a strict hierarchy:

RoleLevelDescription
Owner4Full access. Can manage users, toggle kill switch, manage org settings.
Admin3Create/edit gateways, manage policies. Cannot manage users or toggle kill switch.
Member2View everything. Can approve/deny pending actions. Cannot create or modify gateways or policies.
Viewer1Read-only access to dashboard. Cannot approve actions or modify anything.

Permissions matrix

ActionOwnerAdminMemberViewer
View dashboard, traffic, auditYesYesYesYes
Approve/deny actionsYesYesYesNo
Create/edit gatewaysYesYesNoNo
Create/edit policiesYesYesNoNo
Toggle kill switchYesNoNoNo
Manage usersYesNoNoNo
Change org settingsYesYesNoNo

User management

First user

The first user to register at tameflare.com/register becomes the owner of the organization. This happens automatically.

Inviting team members

Invite team members from the Users page in the dashboard. New users default to the viewer role. Promote them as needed.

Recommended role assignments

Team memberRecommended role
Engineering lead / securityOwner
DevOps / platform engineersAdmin
Developers using agentsMember (can approve their own actions)
Managers / auditorsViewer (read-only)
Tip
Start with viewer for everyone and promote as needed. It's easier to grant access than to revoke it.

New member onboarding

What new members see

When a non-admin user logs in for the first time:

  1. Dashboard overview - current stats (actions today, active gateways, pending approvals)
  2. Traffic log - full visibility into all proxied requests
  3. Audit log - every action, decision, and approval event
  4. Approvals - members can approve/deny pending actions (viewers cannot)

Recommended onboarding steps

  1. Share the dashboard URL - tameflare.com/dashboard
  2. Have them register or send an invite from the Users page
  3. Assign the appropriate role - promote from the Users page
  4. Point them to the traffic log - best way to understand what TameFlare is doing
  5. Share the tf init command for their gateway so they can start running agents

Multi-team setup

For platform teams managing multiple teams or tenants:

  • Create one gateway per team in the dashboard
  • Each gateway has its own connectors, credentials, and permissions
  • Run each team's agents with their own gateway:
# Team A directory
cd ~/team-a && tf init --list && tf run -- python agent.py
 
# Team B directory
cd ~/team-b && tf init --list && tf run -- python agent.py

All gateways share the same org dashboard, so admins have full visibility across teams.

SSO (Single Sign-On)

SSO via SAML and OIDC is planned for the Team tier. This will support Google Workspace, Okta, Azure AD / Entra ID, and generic SAML 2.0 / OIDC providers.

Currently, authentication uses email/password. Use strong, unique passwords for each user.

Data export

Export your data from the dashboard at any time:

  • Audit log - go to Audit Log and click Export CSV
  • Configuration - go to Settings > Export Configuration to download policies and gateway configs as JSON

Exports do not include API keys, credentials, or user accounts (for security).

Next steps