Team and audit log

Team and Audit log are both in the Connections & access section of Settings, and both are workspace-scoped: they cover every brand in your active workspace, not just the one currently selected.

For the role ladder itself (Owner/Admin/Member/Viewer) and how seats relate to brands and billing, see Workspaces, brands, and seats. This page covers the Team page’s day-to-day mechanics and the Audit log.

Managing brand access per member

Owners and admins have implicit access to every brand in the workspace - there’s nothing to grant them. Members and viewers need explicit access, set per member on the Team page:

• All brands - a sticky grant that also covers any brand added to the workspace later.
• Specific brands - a hand-picked set, shown as chips on the member’s row.

A member or viewer can never be left with zero brands. Kreel blocks removing their last brand, and blocks saving an access change that would leave the set empty - grant at least one brand, or switch to All, first.

Changing or removing a member

Owners and admins can change any member’s role or brand access, and remove any member, from their row on the Team page.

A few protections apply:

• Only an owner can change or remove another owner. An admin can act on members and viewers, but not on an owner.
• The workspace’s sole owner can never be demoted or removed. If you need to step back, transfer ownership to someone else first - this hands them the owner role and demotes you to admin in the same action.
• Changing a member’s role takes effect immediately, including for any API key they’ve already created: a key is always judged by its owner’s current role, not the role at the time the key was made.

Pending invites

An invite sits as pending until the invitee accepts it by signing in (or creating an account, for someone brand new to Kreel). Owners and admins can see every pending invite on the Team page and revoke one before it’s accepted.

If the workspace is at its seat limit, sending an invite is blocked with an inline prompt to add a seat - extra seats are billed per workspace, see Billing and profile.

Audit log

The Audit log page (owner/admin only) is a searchable, paginated history of sensitive events across the workspace: team membership changes, API key creation/rotation/revocation, billing changes, connection and OAuth events, and data deletion.

Each row shows:

• Time the event happened.
• Event - a dotted name like member.role_changed or api_key_revoked.
• Outcome - success, failure, or denied.
• Actor - the email of whoever triggered it, or “System” for automated events.
• Brand - the brand it applies to, if any.
• Details - event-specific metadata, expandable to raw JSON.

1. Open Audit log in Settings.
2. Filter by Event family (member, api_key, billing, oauth, connection, deletion, auth) and/or Outcome.
3. Set a Since / Until date range if you’re looking for something specific.
4. Click Load more to page through older events.

Audit events include any that predate a move to workspace-level events (legacy brand-scoped rows), so the history is continuous even across that change. Routine request telemetry is excluded - the log is for actions worth reviewing, not a request trace.

Need help?

Email support@kreel.ai.